Civil and Administrative Tribunal New South Wales Medium Neutral Citation: GCE v Department of Education [2025] NSWCATAD 45 Hearing dates: 29 July 2024 and 1 November 2024 Date of orders: 17 February 2025 Decision date: 17 February 2025 Jurisdiction: Administrative and Equal Opportunity Division Before: M Riordan, Senior Member Decision: (1) The decision under review is affirmed; and (2) The Tribunal takes no action on the matter. Catchwords: ADMINISTRATIVE LAW — Privacy and Personal information — Health information - personal information — whether disclosure to third parties by agency Legislation Cited: Administrative Decisions Review Act 1997 (NSW) Civil and Administrative Tribunal Act 2013 (NSW) Government Information (Public Access) Act 2009 (NSW) Government Sector Employment Act 2013 (NSW) Health Records and Information Privacy Act 2002 (NSW) Privacy and Personal Information Protection Act 1998 (NSW) State Records Act 1998 (NSW) Cases Cited: BWY v Secretary, Department of Education [2020] NSWCATAD 208 Nguyen v Cosmopolitan Homes [2008] NSWCA 246 Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 Texts Cited: None Category: Principal judgment Parties: GCE (Applicant) Department of Education (Respondent) Representation: Applicant (Self-represented) Crown Solicitor (Respondent) File Number(s): 2024/00124351 Publication restriction: The disclosure of the name of the applicant is prohibited pursuant to section 64(1)(a) of the Civil and Administrative Tribunal Act 2013. The applicant is to be known by the pseudonym GCE. REASONS FOR DECISION Background 1. The applicant, GCE, alleges that officers of the Department of Education (the respondent) breached her privacy under the Privacy and Personal Information Protection Act 1998 (NSW) (the PPIPA). 2. In particular, GCE alleges that on 20 February 2019, after she raised concerns about a child's emotional and academic progress, the Learning & Support Teacher and a School Counsellor/Psychologist discussed the child's progress and the steps that the School could take to provide support and assistance. The latter noted that parental consent (via a "Referral to School Counsellor Form") would be sought for the child to undertake cognitive assessments and to contact the Tutoring service that the child had been attending about any screenings for dyslexia and any motor coordination interventions. On 20 February 2019, GCE completed that form. 3. On 14 June 2019, GCE's former Partner (referred to in this decision as RM) completed a Referral to School Counsellor Form for that child. Under the heading "previous assessments", RM referred to "Speech Therapy at (location) Community Health," Dr R Adler and "CAMHS [redacted]." RM consented to the school counsellor conducting the assessment and counselling (as required), but while he circled "yes" to consent to the school counsellor contacting the authors of the reports that he provided, he did not specify any of their names. That was required to give effect to that consent. 4. On or about 15 August 2019, the school psychologist prepared a report, which: 1. summarised the child's background information (including some recent correspondence from his paediatrician and school counsellor reports from 2016), the results of the WISC-V tests and the Wechsler Individual Achievement Tests – Third Edition Australia and New Zealand (WIAT-II); and 2. recommended certain action be taken to address the identified issues. 1. On 15 August 2019, the school counsellor met with GCE to provide her with a copy of this report. On 2 September 2019, he met with RM and provided him with a copy of that report. 2. On 16 September 2019, a meeting was scheduled between RM, the child's classroom teachers and the school psychologist to discuss the existing supports that the School provided for the child. The school psychologist was unable to attend, but suggested that the meeting should proceed without him. 3. On 5 October 2019, RM emailed GCE stating that: 1. he had recently met with the child's teachers and the school psychologist; 2. the children are receiving extra support in the classroom; and 3. the general consensus was that if additional tutoring outside of school was at all beneficial, the benefit would be minor. 1. On 21 June 2022, GCE emailed the school and stated that she believed it was holding a report from Dr Adler, which "is outdated and has no current reflection on our current situation… This report is confidential and I'll need this report destroyed if you have not done this already." 2. Shortly after the school received GCE's email, the relieving Principal (JC) spoke to GCE and stated that the only family law documentation required to be kept on a student's file would be a copy of the Court orders. She subsequently reviewed the child's student record card and made enquiries to confirm that no such family law documents had been received and stored elsewhere. She then advised GCE that no such reports or documents had been located. 3. Separately, on 4 July 2022, the respondent notified GCE in relation to an access application made under the Government Information (Public Access) Act 2009 (the GIPA Act) that she had made in relation to one of her children, that the school did not hold any records of reports provided to the school by RM (or two other named persons). 4. On 4 November 2022, and clarified on 7 November 2022, JG (Director Educational Leadership, School Performance of the area Principals' Network) informed GCE that a further search by the School for "any private and confidential materials (including a psychiatrist's report)" had been undertaken but no such documents had been found. 5. On 15 December 2022, JG informed GCE, inter alia that: 1. A high school (where the child's student record would have been transferred to following his admission in 2021) had recently been asked to search for information (to respond to the GIPA application) and no "private and confidential materials (including a psychiatrist's report)" had been found; and 2. Nevertheless, she had attended that high school to search for any such records, but was not able to locate any such documents. Procedural background 1. GCE lodged a number of previous administrative complaints against the respondent's employees, including a previous application for internal review under s 53 of the PPIPA that she withdrew. In those complaints she alleged that: 1. RM provided outdated, incorrect and confidential information (including a psychiatrist's report) to the School, which had been shared with School staff and which should not have been collected. This complaint could not be substantiated as no such information had been located. The decision was upheld on internal review. 2. SF (the Principal) had inappropriately spoken to one of the children. This complaint could not be substantiated because there were no corroborating accounts. The decision was upheld on internal review. 3. The school had provided a document that outlined that there was criminal behaviour involved in GCE's family. This complaint could not be substantiated as the document in question appeared to be "a Handover Checklist" to transfer the School's counselling files for the child to the new High School and there was no check against "criminal behaviour" in the listed items. 4. RG did not manager her complaint in a serious or compassionate manner or had a conflict of interest. This allegation was dismissed. 1. On 30 August 2023, GCE sent an email to pes@det.nsw.edu.au attaching photographs of an undated application for internal review. This indicated that she was specifically complaining about "the collection of harmful (sic), incorrect, misleading information, sharing of this information to all government organisations." 2. On 27 October 2023, the respondent's Legal Services Directorate received a copy of GCE's email dated 30 August 2023. Between 27 October 2023 and 6 November 2023, the respondent and GCE communicated by phone and email to discuss the conduct that was the subject of the internal review application, as it did not understand which conduct was involved. 3. On 6 November 2023, the respondent emailed GCE and set out its understanding of the conduct that was the subject of the internal review request, was that following her ex-partner sharing a psychiatrist's report about her with SF, SF had been disclosing her opinion of GCE without her consent to: (1) GCE's neighbours; and (2) NDIS, a local health service, the Department of Education and Services Australia. 4. GCE did not object to that articulation of the scope of her complaint until 13 November 2023, when the respondent informed her of SF's absence and that the completion of the internal review would be delayed. First application for administrative review 1. On 16 November 2023, GCE lodged an application for administrative review with the Tribunal. 2. On 13 December 2023, the respondent emailed GCE, seeking particulars of the conduct said to have been raised by her internal review application that was not reflected in its email dated 6 November 2023. 3. Between 13 December 2023 and 14 December 2023, the respondent's solicitor and GCE corresponded regarding the request for particulars and the lack of clarity in GCE's response to that request, and the concerns that the respondent intended to raise at the case conference. GCE replied, "Great talk then." 4. At the case conference on 18 December 2023, before Senior Member Higgins, the respondent's solicitor raised concerns about the Tribunal's jurisdiction to deal with the application, the uncertainty regarding the scope of the internal review application (which the parties had been unable to resolve) and the possibility that some of the conduct complained of was raised out of timeframes. 5. In response, GCE: 1. Confirmed that the scope of her application for internal review was that set out in the respondent's email of 6 November 2023; 2. Asserted that she had "only recently found out about the conduct and that she had documents to prove it;" 3. Accepted that she had lodged her administrative review application before the 60 days for it to be completed under s 53(6) of the PPIPA had expired; and 4. Withdrew her application on the basis that the Tribunal had no jurisdiction. Subsequent developments 1. Following the case conference on 18 December 2023, the respondent's solicitor wrote to GCE requesting copies of the documents that she had referred to during the case conference. However, CGE did not respond. 2. On 21 December 2023, the respondent's solicitor confirmed that the documents requested in the email of 18 December 2023 could be provided with the other documents that GCE would like to have considered, and also sent her an email attaching a letter that set out the scope of the internal review (subject to a determination that no extension of time was required), the expected time to complete the internal review and an invitation to provide material for consideration by 25 January 2024. 3. On 21 January 2024, GCE sent an email to the respondent attaching two screenshots. She stated, inter alia, that she only became aware of the conduct from making a complaint to the NDIS on 11 August 2023 about SF's actions, but she then referred to an alleged conversation between herself and SF about a meeting with RM that occurred prior to 5 October 2019. 4. On 23 January 2024, the respondent's solicitor informed GCE that the scope of the internal review would be limited to the conduct referred to in the email dated 6 November 2023 and requested further information arising from GCE's email dated 21 January 2024. GCE did not respond. 5. On 9 February 2024, GCE requested confirmation that an internal review would be done of SF's conduct. The respondent's solicitor replied by email, again setting out the scope of the internal review and the revised anticipated timeframe, and inviting the applicant to respond to the email request made on 23 January 2024 and provide additional material. GCE replied and asserted, inter alia, that the "family court report" had been provided to school staff. 6. On 26 March 2024, GCE lodged the current application for administrative review, in which she asserted that she had applied for an internal review and that no communication or information was provided by the respondent. Internal review decision 1. On 22 April 2024, the respondent notified GCE of its findings and proposed actions in relation to the internal review, including that it had instructed the Crown Solicitor's Office to conduct a review of the conduct that she alleged constituted a contravention of the PPIPA Act. 2. This review was completed by a Principal Solicitor and the respondent determined: 1. Not to extend time under s 53(3)(d) of the PPIPA for her to complain about the alleged use of her personal and health information by SF, allegedly "sharing" or "disclosing" her opinion of her or information about her contained in a psychiatrist's report relating to family court proceedings, within the relevant public school; 2. There was no breach of the restrictions against disclosure in s 18(2) or 19(2) of the PPIPA or cll 11 and 14 of Sch 1 of the HRIPA as there is no evidence that SF recorded her opinion of her and provided that opinion to her neighbours, the National Disability Insurance Agency, a local health service or Services Australia; and 3. Pursuant to s 53(7) of the PPIPA, not to take any further action on the matter. 1. The respondent also advised GCE of her rights of review to this Tribunal. Current Administrative Review Proceedings 1. On 29 April 2024, Senior Member French SC conducted a case conference, at which GCE was self-represented and Ms Nguyen of the Crown Solicitor's Office appeared for the respondent. The Senior Member made the following orders: (1) He note that the reviewable decision is dated 22 April 2024; (2) He refused to make a non-publication order under s 64(1) of the Civil and Administrative Tribunal Act 2013 (NSW) (the NCAT Act); (3) He ordered the respondent to file and serve a bundle of documents under s 58 of the ADR Act by 24 June 2024; (4) He ordered the GCE to file and serve particulars of her complaint about the conduct of the agency said to be a contravention of the Health Records and Information Privacy Act 2002 (NSW) (the HRIPA) and the PPIPA, evidence and submissions about the alleged conduct and about any financial, psychological or physical harm suffered because of the conduct, by 24 June 2024; (5) He ordered the respondent to file and serve any evidence and submissions in reply by 22 July 2024; and (6) He listed the matter for hearing on 29 July 2024, and gave GCE leave to appear by way of AVL. First hearing 1. The matter came before me for hearing on 29 July 2024. GCE was self-represented and appeared by way of AVL and Ms Nguyen appeared for the respondent. 2. GCE advised the Tribunal that she "felt badly discriminated against" by the respondent because information was used to slander herself and her children, and as a result, one of her children had to move schools the previous year. She said that her younger child is also being discriminated against by the Principal and that she "requires the documents that she sought under the GIPA Act" in order to "amend things." She also alleged that she was not aware of timeframes under the PPIPA and that this was not explained to her. She also alleged that she had "only received an email from NDIS last Friday." 3. In view of these submissions from GCE, the Tribunal decided that the matter was not ready to proceed to determination. 4. I therefore vacated the hearing and I ordered GCE to comply with order four made by Senior Member French on 29 April 2024 by 19 August 2024. I also ordered that on 20 August 2024, the matter would be remitted to the respondent for reconsideration pursuant to s 65(1) of the ADR Act. I listed the matter for a further case conference on 25 September 2024 (at a time to be fixed by the Registrar) and gave GCE leave to participate in that conference by way of AVL. Further case conference 1. On 23 September 2024, Senior Member Ziegler conducted a further case conference. GCE was self-represented and Ms Nguyen appeared for the respondent. The Senior Member noted that GCE had not complied with the Tribunal's orders dated 27 July 2024, and she aside the order remitting the matter to the respondent for reconsideration under s 65(1) of the ADR Act. She ordered GCE to file and serve any affidavit that she intended to rely upon by 30 September 2024 and listed the matter for further hearing on 1 November 2024. Second hearing 1. The matter came before me for further hearing on 1 November 2024. GCE was self-represented and appeared by way of AVL and Ms Nguyen appeared for the respondent. Further evidence from the respondent 1. On 2 October 2024, Ms Nguyen sent an email to GCE, referring to the respondent's s 58 bundle of documents, which included a statement from SF dated 6 February 2024. She asked GCE to advise by 18 October 2024 whether she wished to cross-examine SF, but GCE did not respond. 2. The Tribunal read SF's statement but did not separately mark it as an exhibit. Evidence of SF 1. SF stated that an application for enrolment of a child requires a parent or carer to complete the NSW Department of Education Application to Enrol form. The following information must be provided: (1) Personal and health information about the child, including any additional learning and support needs they have, their medical practitioner details and health conditions (and any treatment plans for those conditions) and their history or circumstances which might pose a risk to another student or staff; (2) Information about the child's siblings (if any); (3) Contact details for the parent or carer and emergency contacts for the child; and (4) Information about their parent's or carer's occupation and level of educational qualifications. 2. Further, if a child has a parent or carer not living with them, copies of any relevant family law or other orders are required to be provided, as the orders enable the school to understand the degree of parental responsibility that parent or carer has over the child and informs, among other things, how it responds to any requests for information about the child from that parent/carer. 3. Once the application to enrol is accepted, it is placed on the child's student record. Other documents that are added and kept on a student record whilst they are enrolled include: (1) Student reports, which refers to their attendance, participation in whole school activities, their social development and commitment to learning and assessed outcomes for each key learning area, subject or course; (2) Revised and/or updated medical treatment plans for the child; (3) Information provided to the school by the parent (for example, medical reports which can only be accessed if the parent allows dissemination); and (4) Records about the support given to the student (for example, Learning Support). 4. SF stated that the student record will generally not include copies of any files kept by the school's counselling staff as those files are kept confidentially in a locked cupboard in the school counselling staff's office. She does not have access to those files. When a student ceases to be enrolled at a school, their student record is transferred to their new school. 5. SF stated that while the Learning Support team take steps to provide reasonable assistance to students and their parents/carers to obtain learning support they need, there are things that her school will not do, including: 1. Writing letters about a student to be provided for the purposes of applying for funding under the National Disability Insurance Scheme (NDIS); or 2. Contacting other agencies (for example Centrelink, a local health service, Services Australia) or medical practitioners to obtain information about the student and/or their families. 1. SF also stated that parents/carers may possibly request external health practitioners who assess their children to provide copies of their reports to the school. In those circumstances, her school: (1) Contacts the parent/carer to confirm that they would like the school to receive a copy of the report; and (2) Adds a copy of the report to the student's record and, with the consent of the parent/carer, makes a copy of the report available to relevant staff (for example, the school counsellor or the Learning Support Team). 2. SF stated, relevantly: 14 I understand (GCE) has made an internal review application under the (PPIPA) in October 2023 contending that: after her former partner, (RM) shared a psychiatrist report from the Family Court proceedings with me, I disclosed my opinion about (her), without her consent, to: a. her neighbours; b. the NDIS, which I understand to refer to the National Disability Insurance Agency (NDIA); c. [redacted] Health; d. The Department of Education; and e. Services Australia. 1. SF stated that: 1. she does not know and cannot recall ever interacting with RM; 2. She did not attend a meeting on/before 5 October 2019 (which RM allegedly attended); 3. She has not seen or been provided with a psychiatrist report connected with Family Court proceedings involving GCE and RM; 4. Since an incident over a decade ago arising from a letter she drafted for another parent on School letterhead for the purpose of Court proceedings, she has taken considerable care not to send written correspondence about any students or their parents to a body external from the Department; 5. She has not discussed anything about GCE to the NDIA, the local health service or Services Australia; 6. She does not know who GCE's neighbours are, but she did not recall discussing anything about GCE with anyone outside the Department; 7. Prior to GCE's complaint made about her conduct in late-2022, where she was asked to provide a response to allegations by JG, she did not recall discussing anything about GCE with the Department; and 8. If she ever referred to GCE in a discussion with staff at (the school), it would have been in the context of: 1. processing (the children's) applications to enrol at the school; and 2. being consulted about the learning support and assistance that could be provided to (the children) or their classroom teachers. Further evidence from GCE 1. On 8 October 2024, GCE filed an affidavit dated 30 September 2024, in which she sought to greatly expand the scope of her allegations against the respondent and, by extension, the scope of the current administrative review. 2. Ms Nguyen started that she did not wish to cross-examine GCE on her affidavit. The Tribunal read the affidavit, but did not separately mark it as an exhibit. I have summarised its relevant parts as follows. 1. GCE alleged that RM and another named person "have a pattern of sharing incorrect information, and planning calculated mistreatment of me and my family, what I have endured is heartbreaking behaviour." She stated that "this has been ongoing for the last 15 years" and that "we are experiencing coercive control, this is an ongoing abuse our family is going through and has almost broken my spirit more than once". She also alleged that RM and that other person "have consistently provided misleading and incorrect information, using my personal information unethically. They have accessed my records without consent, causing significant harm, this is evidenced by the documents provided by the Education Department and other Freedom of Information applications." 2. GCE stated that on 20 February 2019, the school psychologist completed "a referral to the school counsellor for her eldest child" without her consent and that this indicated that a "previous psych assessment" was on file. She said that she was not aware of a "previous psych assessment done with education department" and that she had "only ever consented to emotional support and assessments done for extra support for (the child's) educational needs." She believed that RM had provided the school with a family court psychiatrist's assessment. 3. GCE referred to an email exchange between herself and RM, outlining a meeting organised with RM for education support at (the public school) with SF and the teachers. She alleged that she had spoken to SF about this and that SF told her she attended that meeting. She also stated, relevantly: Not long after receiving the email from RM, I visited (the public school) and spoke with (SF), requesting a letter outlining the importance of continuing tutoring to support my claim with child support for equal payment of tutoring fees. (SF) dismissed tutoring as a waste of time and aligned with RM's views, claiming there had been no change in (the child's) learning… I believe this is when RM showed the staff another copy of this Family court psychiatrist report… (The school) refused to add any extra support for my children's learning or provide a recommendation letter for NDIS. (SF) wrote a letter to the NDIS containing misleading and malicious statements without evidence supporting (RM) and her cruel, misleading and incorrect opinion. I contacted (the school) about a grant I wanted to apply for, which was for single and low-income families, but my request was refused. I spoke via email with (SF), stating that it went against the Education Department policies to write a letter of support with the school letterhead, the letterhead was one of the conditions of application… I applied under the GIPA Act for my children's information, as I could not comprehend how a public school could be so unhelpful and cruel towards myself. During this process, I learned that a family psychiatrist report had been provided to the school without my consent during a meeting with (SF). I started making complaints with the NSW Education department… I was misinformed … about the complaints process… I briefly spoke and emailed the Acting Principal about destroying the family report if it was on file. The Acting Principal explained she could check if this information was on file and would also check if this was in my children's council file. Throughout the time my children had been at (the public school) I was told there was no access to this confidential cupboard that had all the school counsellor information in it. The educational department's acceptance of the family court report is inappropriate, using this report to knowingly harm a vulnerable family is a breach of my and my children's human rights, particularly as (RM) has a past behaviour of weaponizing information. I believe the education department has been following incorrect and misleading family court orders, as this is an ongoing behaviour of (RM and the other person). These Court orders were accusations that were proven to be rubbish by the Family Court. The Education Department have not provided what family court orders (the public school) were following… 1. GCE also asserted for the first time that her children's phones and YouTube accounts "have been self-linking to their school email accounts without consent or permission, raising concerns about our privacy and unauthorised access to student's information." She also alleged that the respondent "has denied me any course of justice… My understanding of my basic rights was non-existent at this stage of my life, I had no knowledge of the complaints process, and all links provided by the education department on my complaints rights were not visible or accessible on all my devices e.g. recommended links wouldn't open or the page didn't exist." 2. GCE complained that JG was "guilty of unethical conduct and conflict of interest," but that another officer (DW) found that her actions were fair and correct. She also alleged that her eldest son was accepted and later denied enrolment at a private high school, as follows: 41. …based on incorrect information provided by his father and the educational departments external database. I complained to the [education provider], but received no response regarding my son's failed enrolment. 42. I'm concerned and believe the Education Department has followed the wrong Family Court orders provided by (RM), the education department ignore all legel (sic) documents provided by myself, this has led to the Education Department fuelling family abuse and coercive control, doing the abusers work so to speak. 43. I have continuously advocated for my children's educational needs, yet the Education System has only destroyed evidence and slandered me and my innocent children in their external databases. My concerns have never been properly addressed, leaving me feeling ignored and the situation becoming bigger and bigger… 46. The Department of Education has violated their own code of conduct, our basic human rights and has failed to adhere to the basic laws that protected the vulnerable people in our community. 47. My children are enrolled in government outside-school activities and this incorrect information on their records has hindered their opportunities in these programs. 48. The incorrect information on the school external database has caused other organisations such as the [redacted] Fire Brigade Junior program to discriminate against our family based on information provided from the education department and other government departments. 48a. These public platforms have continue to abuse our family by adding more incorrect information provided by the (name) family and others who have no moral compasses. 49. I hope the educational department can reconsider the internal report again to reflect the truth and injustice of a vulnerable family, who is trying to clean up a mess that one abusive man started. It shouldn't be me fighting to fix this matter up but unfortunately I have no other option, or no other legal support. Non-publication order 1. The Tribunal determined that it was appropriate to make a non-publication order under s 61(1)(a) of the NCAT Act, restricting the publication of the applicant's name. I ordered that she be identified by the pseudonym "GCE." Decision reserved 1. The Tribunal reserved its decision. Relevant legislation ADR Act 1. Section 63 provides: (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law. (2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision. (3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or (d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal. PPIPA 1. Section 18 provides: Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless— (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 1. Section 19(2) provides, relevantly: A public sector agency that holds personal information about an individual must not disclose the information to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless— (a) the public sector agency reasonably believes that the recipient of the information is subject to a law, binding scheme or contract that effectively upholds principles for fair handling of the information that are substantially similar to the information protection principles, or (b) the individual expressly consents to the disclosure, … HRIPA 1. Clause 11 of Schedule 1 provides, relevantly: Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless— (a) Consent the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note— For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. 1. Clause 14 of Sch 1 provides, relevantly: An organisation must not transfer health information about an individual to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless— (a) the organisation reasonably believes that the recipient of the information is subject to a law, binding scheme or contract that effectively upholds principles for fair handling of the information that are substantially similar to the Health Privacy Principles, or (b) the individual consents to the transfer, or Consideration Issues requiring determination. 1. In my view, the issues to be determined are: 1. The proper scope of reviewable conduct; 2. Whether there was a breach of either the PPIPA and/or the HRIPA?; and 3. What is the outcome. Proper scope of reviewable conduct 1. GCE sought to greatly expand the scope of the alleged conduct by the respondent in her affidavit dated 30 September 2024. On 29 July 2024, the Tribunal ordered her to file and serve any evidence that she relied upon, with a view to that evidence being before the respondent for reconsideration under s 65 of the ADR Act. However, she did not comply with that order and the remittal order was revoked by Senior Member Ziegler at the second case conference. 2. I am satisfied that the scope of the reviewable conduct is set out in para no. 1 of the respondent's submissions filed on 25 July 2024, as follows: By application field on 26 March 2024, and amended on 29 July 2024, (GCE) seeks administrative review under s 53 of the (PPIPA) and s 21 of the (HRIPA) of the conduct of the Department of Education… arising from (SF), Principal of (name) Public School…, allegedly "disclosing" her opinion of the applicant to: a. the applicant's neighbours; b. the National Disability Insurance Agency (the NDIA); c. [redacted] Health; and d. Services Australia. 1. The respondent argued that GCE's allegation that SF disclosed her opinion of her within the school was made outside the time allowed in s 53(3)(d) PPIPA, and that the Tribunal cannot review it in these proceedings. 2. However, GCE disputed this and stated that she became aware of that conduct "on 29 September 2022", and therefore, the 6 month limitation ends on 29 March 2023. She also alleged that she "was manipulated and confused by the respondent into discontinuing an earlier privacy complaint" and that that in April 2024, she made a complaint about JG's conduct. She also argued that the respondent's conduct was "fuelling family abuse and coercive control, doing the abusers' work so to speak." 3. None of these additional allegations and assertions have been the subject of a decision or an internal review by the respondent under the PPIPA and/or the HRIPA. 4. Accordingly, I am satisfied that these matters are outside the scope of the current application for administrative review and that the Tribunal lacks jurisdiction to review them. Was there a breach of either the PPIPA or HRIPA? 1. GCE filed a large volume of documents, but her "evidence" is restricted to her affidavit dated 30 September 2024. She was given an opportunity to cross-examine SF in circumstances where there is an obvious conflict in their evidence and recollection of the events that are currently before the Tribunal. However, GCE did not avail herself of that opportunity and SF's evidence was not challenged. 2. In reviewing the respondent's conduct under s 55 of the PPIPA and s 21 of the HRIPA, the Tribunal's task is to decide what the correct and preferable decision is, having regard to the material before it. If, in undertaking this task and after reviewing all the evidence, the Tribunal is left in a state of uncertainty about a fact in issue, then that fact should be decided against the applicant as the applicant bears the practical onus of proof in these proceedings. 3. For the purposes of s 55 of the PPIPA and s 21 of the HRIPA, the respondent's "conduct" includes any actual or alleged contravention of any applicable Information Privacy Principle (IPP) or Health Privacy Principle (HPP): see s 52(1)-(2) PPIPA & s 21(2)(a) HRIPA. 4. The IPPs apply to public sector agencies to regulate their dealings with "personal information": see s 30 PPIPA. The HPPs apply to, and are required to be complied with by, "organisations" that are health service providers or otherwise collect, hold or use "health information": see s 11(1)-(2) HRIPA. 5. The respondent is listed as a "Department" in Part 1 of Sch 1 to the Government Sector Employment Act 2013 (NSW) (the GSE Act). It is therefore a "Public Sector Service Agency" for the purposes of the GSE Act. 6. A "public sector agency" is defined in s 3(1) of the PPIPA to include a "Public Service Agency", which is likely to have the same meaning as it does under the GSE Act. Therefore, the respondent is a "public sector agency" for the purposes of the PPIPA. 7. A "public sector agency" is defined in s 4(1) of the HRIPA to include "a government department", and it also an organisation for the purposes of the HRIPA. 8. As a result, the respondent is required to comply with the IPPs and HPPs. 9. With respect to the respondent's conduct that is within the scope of these proceedings, it is necessary to consider whether the disclosure IPPs and/or the disclosure HPPs apply. This is because while GCE has identified what she considers SF's alleged opinion of her to have been informed by, she has not clearly articulated or provided any documentation evidencing the opinion that SF allegedly disclosed. This is required in order to assess whether that opinion would fall within the meaning of "personal information" for the purposes of the PPIPA or "health information" for the purposes of the HRIPA. 10. As GCE did not file her affidavit until shortly before the second hearing, the respondent's written submissions were based on the premise that the IPPs and HPPs apply in this matter. It argued, and correctly so in my view, that for the respondent to have breached either ss 18(1) or 19(2) of the PPIPA, or cl 14 of Sch 1 of the HRIPA, the following factors must be established: 1. That the respondent "holds" GCE's personal and health information; 2. That there was a "disclosure" of that personal and health information; and 3. That none of the lawful exceptions or exemptions to the restrictions against disclosure of personal and health information (including those provided by the respondent's Privacy Code of Practice made under Div 1 of Pt 2 of the PPIPA) apply. 1. For the purposes of the IPPs, personal and health information is "held" by a public sector agency in the following circumstances: 1. If the agency is in possession or control of the information; 2. If the information is in the possession or control of a person employed or engaged by the organisation in the course of such employment or engagement; or 3. If the information is contained in a State Record in respect of which the agency is responsible under the State Records Act 1998 (NSW). 1. Information that is not recorded in material form, but is only in an employee's mind, such a view or an opinion, will not be held by an agency for the purposes of the PPIPA or the HRIPA as neither the employee nor the agency is in possession or control of the employee's mind: see Vice-Chancellor Macquarie University v FM [2005] NSWCA 192; BWY v Secretary, Department of Education [2020] NSWCATAD 208 at [52], [55]. 2. For there to be a disclosure of information by a public sector agency for the purposes of the PPIPA or HRIPA, the information must be provided to a person and the person must not have previously known or been aware of it. 3. There is a clear conflict between the evidence of GCE and SF, but while GCE's affidavit clearly sought to impugn SF's evidence, she did not challenge SF's evidence by way of cross-examination. I regard this as being significant given the absence of evidence in GCE's case as to the nature and terms of the opinion about her that SF allegedly disclosed. 4. In my view, GCE's affidavit does not establish a safe climate for a finding that her evidence should be preferred to that of SF, and where the is a direct conflict I prefer the evidence of SF. This particularly applies to GCE's allegation that SF reduced her opinion to writing before she disclosed it. 5. In Nguyen v Cosmopolitan Homes [2008] NSWCA 246, the Court of Appeal (McDougall J, McColl & Bell JJA agreeing) stated: On analysis, I think what their Honours said is not inconsistent with the requirement that the tribunal of fact be actually persuaded of the occurrence or existence of the fact before it can be found. On their Honours' approach, what is required is a determination of the respective probabilities of the event' having occurred or not occurred. There is nothing in that analysis to suggest that the determination in favour of probability of occurrence should not require some sense of actual persuasion. 1. Based on a consideration of all of the evidence before me, I do not feel a sense of actual persuasion that the conduct alleged by GCE against SF occurred in the manner alleged, or at all. 2. I am not satisfied that SF reduced her alleged opinion of GCE to writing at any time and it therefore follows that I am not satisfied that SF allegedly disclosed personal information of GCE that was held by the respondent. 3. Accordingly, I am not satisfied that GCE has discharged her practical onus of proving that there has been a breach of privacy by the respondent. Conclusion 1. I find that the respondent did not breach of ss 18(1) and 19(2) of the PPIPA and/or cll 11 and 14 of Sch 1 of the HRIPA. 2. Accordingly, I make the following orders: 1. The decision under review is affirmed; and 2. The Tribunal takes no action on the matter. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 17 February 2025