CITATION: QE and anor v Macquarie University [2008] NSWADT 144 DIVISION: General Division APPLICANT QE RESPONDENT Macquarie University PARTIES: APPLICANT QF RESPONDENT Macquarie University FILE NUMBER: 053178, 053179 HEARING DATES: 23-24 April 2007, 14 June 2007, 24 August 2007, 1 November 2007 SUBMISSIONS CLOSED: 19 December 2007 DATE OF DECISION: 26 May 2008 BEFORE: Wilson R - Judicial Member CATCHWORDS: Privacy - information protection principle - personal information - adequate safeguards in place - whether records should be amended - costs MATTER FOR DECISION: Principal matter LEGISLATION CITED : Privacy and Personal Information Protection Act 1998 Director-General, Department of Education and Training v MT (2006) 67 NSWLR 237 CASES CITED: Gizah Pty Ltd v AXA Trustees Ltd (No. 2) [2007] NSWADT 164 NS v Commissioner Corrective Services [2004] NSWADT 263 APPLICANTS In person REPRESENTATION: RESPONDENT M Allars, barrister In relation to proceedings 053179 (QF v Macquarie University):1.The decision under review is set aside insofar as it considers the application made pursuant to section 15 of the Privacy and Personal Information Protection Act 1998 and a determination that the recorded grades or outcomes for courses EDUC 106, TEP 312 and TEP 333 remain as shown in those records is substituted therefore 2. The parties are granted liberty to apply for further directions, should they so wish, in relation to any request that is alleged pursuant to section 15 of the Act to attach a statement to information held by the respondent concerning any of these three courses, such liberty to expire 14 days after receipt of a copy of these reasons for decision. ORDERS: In relation to both proceedings: 3. Otherwise the decision under review is affirmed for the reasons given herein 4. The time taken by the respondent to determine the review was reasonable in the circumstances for the reasons given herein 5. No order is made as to the costs of the proceedings. REASONS FOR DECISION 1 The applicants have brought these proceedings pursuant to the provisions of the Privacy and Personal Information Protection Act 1998. The essential allegations are that the respondent has disclosed personal information concerning both applicants and additionally, has failed to act so as to protect such information from unauthorised disclosure. No jurisdictional issues are involved, although a number of interlocutory matters arose for consideration during the course of the hearing. These matters are considered below. 2 It is convenient to refer to the applicants in these reasons as "the first applicant", or by the initials "QE", and as "the second applicant", or by the initials "QF". The reason for this is that the information that was alleged to have been disclosed directly concerned the first applicant's wife, who is the second applicant. The second applicant did not join in the first applicant's proceedings (sub nom QE v Macquarie University, proceeding number 053178) as a party, but she in fact commenced her own application in the Tribunal (sub nom QF v Macquarie University, proceedings number 053179). The second applicant's proceedings involve allegations that personal information of hers was disclosed as well as submissions that certain records pertaining to, her kept by the respondent, were in error and should be altered in a number of ways. 3 The proceedings brought by both the first and the second applicant involves, to a large extent, a common sub-stratum of facts, albeit with differences. Also, the first applicant represented the second applicant at the hearing of the second applicant's matter. For these reasons the two sets of proceedings were heard at the same sittings, the parties agreeing to this course, although in principle the proceedings were regarded as being separate matters. This was relaxed to some extent in that the evidence by the applicants was, in form, a composite of the evidence said to be relevant to both proceedings. The respondent was content to leave the applicant's evidence in this form upon the understanding that only relevant evidence would be received in each proceeding. The respondent prepared and filed separate evidence in each matter, although there still remained much evidence common to both. In addition a flexible approach was adopted by the parties in relation to submissions. The parties should be commended in following this practical approach. By reason of these circumstances and the common substratum of facts the most convenient course is to deliver a joint determination for these two proceedings. 4 Both parties have approached these proceedings with a firmness of mind and clarity of thought that does both sides credit. Their firm resolution and responsible attitude has enabled them to present evidence in a proper manner and to make clear submissions pertaining to the issues in the case. They should both be commended for this as well. It became obvious during the course of the hearing that the applicants, although acting without legal representation, had a good grasp of the issues and the relevant evidence and were able to present their submissions clearly. Also, no complaint can be made by them as to the professional way in which the respondent has conducted its case. Consequently, the Tribunal is persuaded that it can rely quite confidently on the clarity and fullness of the submissions that have been made by both sides. This has enabled the Tribunal to reach its decisions confidently and to formulate these reasons on some points without a detailed discussion of the evidence. This has been of great assistance. 5 As noted above the first and second applicants are husband and wife. At material times the first applicant was employed in an academic position by the respondent University and the second applicant was a student conducting research at that same University. The respondent of course maintained files in relation to each applicant containing relevant information about each of them. The first applicant was in employment with the respondent in 2004 and during the course of that year the second applicant returned to candidature as a student at the same University. Upon resuming studies the second applicant also resumed a scholarship that was provided by the respondent, which entitled her to monetary benefits. She had been on approved leave from her studies in preceding years. At that time the first applicant was involved in litigation with a third party, his former wife. 6 In about August or September 2004 the solicitors acting for this third party came into possession of information pertaining mainly to the affairs of the second applicant, but also pertaining, on one view, in a less direct way to the affairs of the first applicant. The applicants allege that this information was provided to these solicitors in a way that involved breaches of the privacy legislation by the respondent or by the acts of a person for whom the respondent was responsible ("the first breach"). The second applicant requested the respondent to investigate these alleged breaches. During the course of investigating such allegations the solicitor acting for the respondent, a Ms Jennifer O'Brien, made enquiries with the solicitor acting for the third party, a Mr Clayton Long. The applicants further allege that during the course of these communications Ms O'Brien provided information to Mr Long, again in breach of the Privacy legislation ("the second breach"). These two alleged breaches are the gravamen of the claims made by the first and second applicants in the proceedings that they have brought in the Tribunal together with an allegation that the respondent did not have in place sufficient safeguards against unauthorised access, user and disclosure. The second applicant's proceedings (QF v Macquarie University, number 053179) involve an additional claim relating to correction of records. 7 Extensive evidence was adduced in the proceedings and the submissions ranged across quite a number of issues, both factual and legal. In relation to the first alleged breach, it is clear that the third party's solicitors did come into possession of information concerning QF. Consequently, it became critical to determine, as a matter of fact, where this information had come from, how it had been obtained and through whose hands it had passed. These are of course factual determinations to be made upon the evidence adduced in the proceedings and they may properly be made by way of inference, and in the absence of direct evidence, where the circumstances so permit. THE FIRST BREACH 8 The first breach is said to have been revealed in the following way. By letter dated 07.09.04 Mr Long's firm wrote to Messrs Ian Bullock and Partners, the solicitors acting for QE in the litigation that QE had on foot with the third party. This letter appears in various places in the evidence, but see for example exhibit A2, annexure A. As noted, Mr Long's firm acted for the third party. Basically it demonstrated that the author had come into possession of information concerning the second applicant's student and financial status: it concerned her resumption of studies and her scholarship allowance and therefore could have come from the files maintained by the University. The copy of this letter in evidence is not complete, as certain parts of the original letter have been deleted. This occurred at the time that QF made her original complaint: she provided a copy of this letter to the respondent with the deletions shown in the exhibit so as to conceal certain information in the letter which she did not wish to reveal to the respondent. It is not suggested that there was anything untoward in this. Unfortunately though, it does mean that the Tribunal is not able to know the entire contents of the letter when forming factual assessments. No doubt a full copy of the letter could have been obtained from the files maintained by the solicitors involved in the litigation, but the parties have not sought to do this. It is clear that this letter contained information pertaining to QF, particularly in relation to her resumption of studies and her scholarship benefits. It asserted that this information was relevant to the litigation in which QE was then embroiled with the third party, essentially by reason of the monetary amounts that were payable to QF under her scholarship. As this necessarily means that this information was relevant to QE's financial position, so the first applicant argues, it was therefore information pertaining to him as well, albeit in a less direct way. In her oral evidence the second applicant explained that this deleted part of the letter contained statements that made the first applicant "look very bad" (transcript 24.08.07 at page 45.5), so the deletions may not have been of much assistance in any event. 9 This letter from Mr Long's firm also contains a statement as to how this information was obtained. It is alleged that this demonstrates, and is evidence of, how the breach occurred. The letter explains that the third party made direct enquiries with the respondent and as a result learned that QF had returned to her studies at the respondent's institution and that QF's scholarship was of a particular value (stated as being an approximate monetary figure). It is also stated that the respondent had advised the third party what this approximate figure was. It further stated that the respondent was unable to advise (the third party) whether QF had resumed her studies on a full-time or a part-time basis. The subject matter of this letter was spousal maintenance, the third party being QE's former wife. 10 It is quite clear from this letter, without more, that it is open to the Tribunal to find, should it be so persuaded, that the third party had made enquiries with an officer, or officers, of the respondent and had obtained the information set out therein. It is also open to the Tribunal to find that the officer, or officers, so involved with the enquiry had obtained this information from records maintained by the respondent concerning QF's studies and scholarship entitlements. A simple reading of the letter is sufficient to permit such findings by way of inference. Of course, even though such inferences are open to the Tribunal, there is a secondary question whether the Tribunal is persuaded that such inferences should be drawn. The first applicant submits that the Tribunal should draw such inferences, and make appropriate findings of fact. The respondent submits that these finding are not open by way of inference and that, if they are, they should not be drawn in any event for two reasons: firstly, the evidence is not sufficient to persuade the Tribunal to draw the inferences proposed and, secondly, there is additional evidence which give rise to competing inferences that are preferable, or at least equal to, to the inferences proposed by the first applicant. If inferences are to be drawn, submits the respondent, they should be the competing inferences shown by this other evidence. 11 Consequently, the initial, and critical, factual matter for consideration on this issue is the determination, as a question of fact, as to how the information about QF that is contained in this letter was obtained. Once the relevant facts have been established, and if they are such that personal information maintained by the respondent was accessed and passed on, it is then possible to move on to determine whether the acts involved were such that the respondent should be held liable for them. Once these several matters are determined it will then be possible to make an ultimate finding as to whether these acts establish a breach of the Privacy legislation for which the respondent is liable. 12 The letter from Mr Long's firm dated 07.09.04 found its way into Ms O'Brien's hands at the time that she assumed responsibility for investigating the applicants' claims. During investigation she spoke with Mr Long, who was well known to her professionally, on 01.10.04. When she spoke with Mr Long about this letter he said that the letter was unfortunately worded in that it suggested that "official enquiries were made of the University" (see exhibit R 7(1)). Clearly the first letter does more than just suggest this, it actually states that this is what occurred. Mr Long then explained to Ms O'Brien that the information had been provided to the third party by friends of hers who were "on campus" and who supplied the third party with information concerning QE and QF from time to time. Mr Long said that he would write a further letter to Ms O'Brien explaining the true situation (the second letter). 13 Mr Long then wrote to Ms O'Brien on 01.10.04 (exhibit R 7(1), annexure C) saying, "perhaps the terminology used in the letter was a little unclear" (this being a reference to the first letter dated 07.09.04 to Ian Bullock Partners). This second letter then states that the earlier letter was not intended to suggest that any formal enquiry had been made of the University nor of the University Administration "in any way". It explains that he had been instructed by the third party that she had made enquiries of acquaintances at the University "who we understand made responses based on personal observation of what can only be regarded as public domain information in any event". It then states that "there should be no imputation from our letter that the University administration were involved in any way". It is very difficult to find a basis for placing any reliance upon the assertions set forth in Mr Long's letter of 01.10.04, save for the fact that he is a solicitor. Mr. Long does not appear to be the author of the earlier letter of 07.09.04 as the reference initials on the letterhead are different (MAM:SS rather than CAL:cm) and there is no explanation of how Mr Long derived the information, which he based the later letter upon. He may have spoken with the client, with another solicitor who perhaps authored the first letter or who obtained original instructions from the client, or he may have simply read a file note. Absent any evidence of this nature it is impossible for the Tribunal to be persuaded that the information he obtained was accurate or that it truly supported the assertions in Mr Long' letter. The assertion that the earlier letter was not intended to suggest that a formal enquiry had been made of the University or its Administration has no persuasive force when the first letter expressly states otherwise. The only view open about the first letter is that it was intended to assert as fact that the client had made direct enquiries with the respondent University. No other reading of the letter is possible. Further it goes on to state "Our advice from the University is that …". There is no scope for explaining the wording of the first letter on the basis of inaccuracy in the language used, nor is there any basis for saying that "the terminology used in the letter was a little unclear". The meaning of the first letter was perfectly clear. Consequently, Mr Long's letter of 01.10.04 is not persuasive in any way insofar as it endeavours to explain the true implications of the earlier letter and what it was intended to convey. Without Mr Long being called to give evidence the Tribunal is unable to give the second letter any weight. 14 In his letter of 01.10.04 Mr Long also states that his client "directly made enquiries of acquaintances at the University who we understand made responses based on personal observation …". This statement is put on the basis that his client, it seems, so instructed him. However, there is no express statement by Mr Long in this letter that his client instructed him that she did not make enquiries with the University Administration, this being a circumstance that is implied by the letter rather than expressly stated. There is no direct statement that these "acquaintances" were other than University employees, although the implication that they were not is there. Also, to qualify the statement that the acquaintances of the client "made responses based on personal observation" by the words "we understand", as Mr Long does in his letter, suggests that Mr Long did not in fact know the true source of the information that his firm had obtained concerning QF. There is obviously no way that even he was able to test the accuracy of the instructions that his client appears to have given him or his firm, in relation to both the first and the second letters. 15 For these reasons the Tribunal is not persuaded that it should make findings of fact based upon the assertions made in Mr Long's letter of 01.10.04. That letter simply contains assertions that can be given no weight in the circumstances. They may be right, but equally they may be wrong. They have no weight and cannot be relied upon. In particular, this letter cannot be regarded as containing a reliable explanation of what the first letter intended to convey nor can it be relied upon to establish the truth of the factual assertions made therein. 16 Prior to the commencement of the hearing the respondent followed up on Mr Long's letter dated 01.10.04. The respondent made enquiries with Mr Long and his client to ascertain whether either of them would provide a statement of evidence for use in these proceedings (exhibit R 5(1)). However they declined to assist voluntarily. Neither party endeavoured to bring these persons forward as witnesses pursuant to summons. In the circumstances it is not appropriate to employ the absence of any evidence from these two potential witnesses to support any inferences that may be available on the evidence as it is possible that neither of these two witnesses would have been able to give direct evidence as to how the information about QF was in fact obtained, although they could of course have initiated lines of enquiry in this regard. The Tribunal is not satisfied that there is a clear case that one or other of the parties ought to have necessarily called Mr Long or his client. The respondent took the wise step of requesting assistance but when this was not forthcoming the process was not pressed further. The first applicant of course would have anticipated that Mr Long's client would be reluctant to give any evidence favourable to the first applicant's case, and he was unaware of her current address (transcript 13.09.07 page 66.39). Both sides, as matters developed, behaved reasonably in not issuing summonses for these two to attend as witnesses and they should not be penalised for this. The same observations apply generally to the failure of the parties to call the other person who could have been the actual author of the letter of 07.09.04. Although evidence from these persons would have assisted, it is not appropriate to reach factual determinations by way of inference using the absence of these potential witnesses to support the inferences that are open to be drawn. 17 Consequently, the only firm evidence on the question whether QF's information was obtained from the respondent's records, following formal enquiry, is the letter from Mr Long's firm dated 07.09.04 and its contents, being information that could have come from the respondent's files. The letter was written at a time, and in circumstances, where in the normal course one would expect it to be truthful. The applicant, quite correctly, relies upon this document and argues that it establishes an essential element in his case, namely that the information did emanate from the respondent's records or, to put it another way, was the result of direct enquiries made with officers employed in the University's Administration. Quite plainly this letter says that it did. However, at its highest, what is said in this letter must have been based on instructions that were given to the author of that letter by the third party. There are three reasons for this. Firstly, if the respondent had ascertained through its internal enquiries that an officer employed by the University had in fact obtained QF's information from the University files, and passed it on, it would have conceded the point in this Tribunal, whereas no such concession has been made. This is clear from the way in which the respondent has reacted when it was ascertained that earlier evidence concerning tracking access to files was found to be incorrect: the respondent promptly corrected this error with appropriate evidence explaining why it had occurred. Secondly, the letter of 07.09.04 does not state that Mr Long's firm made direct enquiries with the University, it refers to instructions given to it by the third party. Thirdly, if Mr Long had ascertained that his firm did in fact make direct enquiries with the University it is most likely that he would have said so in his letter of 01.10.04, given his professional status. The author of that letter could not have known whether the assertions were true or not. Whilst the better view is that the third party did in fact tell the author of the letter that the information concerning QF had been obtained from University files this is not the same as proof that the information was in fact obtained in this way. Therefore it is quite plain that if the assertions in the letter of 07.09.04 are to be accepted there needs to be some evidence that the instructions given to the author of this letter, upon which these assertions were made, were in true in fact. 18 The letter of 07.09.04 refers to information concerning QF that is quite specific, and correct, and it thereby suggests that the information could well have been obtained by a perusal of records maintained by the respondent pertaining to QF. It refers to the fact that she has returned to her scholarship course, that she is engaged in research work and that for this work she is receiving approximately $18,000 per annum. It is most unlikely that this information could have been obtained by simply observing QF's presence on the University campus. Something more than this is required to explain the detail contained in the information. In addition the letter is drawn with a certain firmness: it asserts the information obtained about QF as fact rather than making an enquiry about QF upon the basis that she has been observed on campus. The tenor of this letter is that it suggests that the information that had been passed on came from a reliable source and is accurate. The author of that letter does not enquire whether the information stated therein is correct or seek confirmation thereof. The only request is for advice as to whether QF is engaged in part-time or full-time research. 19 Whilst these considerations assist the first applicant's case they do not mean that the inference pressed by the first applicant should ultimately be drawn. This question depends upon whether there is reliable evidence suggesting that the instruction given to the author of the letter dated 07.09.04, namely that enquiries had been made with the University or its administrative officers, truly states what in fact had occurred. The statement in the letter, on any view, is made by someone who did not have direct knowledge of what in fact had occurred. In these circumstances, to persuade a tribunal of fact that this statement reflects what in fact occurred, something more is needed. There would need to be some other evidence supporting the inference by tending to show that the statement was correct in fact or reliable in some other way. 20 The respondent clearly had in place controls on the release of personal information (exhibit R 14) so that all staff members accessing records were aware of the relevant restrictions. This cannot be doubted. If a direct enquiry had been made of the University concerning QF, and QF's files had been perused in order to give reply, the officer would have become aware, during the course of enquiry at the latest, of these restrictions. Consequently, it is unlikely that there has simply been an overt enquiry made to the respondent, which has been responded to, in the ordinary course of business and in breach of these restrictions. What is more likely is that the information, if it was obtained from QF's files, was released covertly by an officer who was aware that the information was being released by him or her in breach of these restrictions. In truth, this is in fact how the first applicant puts his case, rather than upon the basis of the literal truth of the assertions in the letter dated 07.09.04. 21 It follows from this that that it is unsafe to take the assertions in the letter of 07.09.04 at their face value. They are assertions made in the course of litigation, which clearly was acrimonious. It is true that the author of the letter of 07.09.04 writes with a certain firmness of mind. The author treats QF"s return to study and the quantum of her earnings as demonstrable fact, rather than untested information that may or may not be true. However, the Tribunal is not persuaded that it is safe to draw the suggested inference upon this basis. At the time the first applicant and the third party were involved in litigation and it could well be that the letter was authored in a firmer way than the instructions actually permitted. Without more cogent evidence, to draw the inference would be unsafe, as it may well be wrong. Unless the evidence has sufficient persuasive force to compel the Tribunal to the conclusion that the inference is the correct one to be drawn, then the Tribunal should not do so. Consequently, the Tribunal is not persuaded that it should find that the information concerning QF was obtained by a direct and open enquiry to the University administration as the letter asserts. 22 This brings up for consideration the first applicant's main submission that the information was obtained by some form of covert enquiry whereby access is gained to QF's files to obtain the information that was passed on. The respondent's evidence was that access to relevant files was not recorded and that there was no method whereby access could be tracked by enquiry at a later date. This was common ground. Apart from electronic storage of information it is also clear that there were paper copy documents in existence (see for example exhibit R 11). 23 It would be an astute observation to see the situation as being one where an employee of the University, who is a friend of the third party and knows something of her affairs, on becoming aware in some way that QF has commenced to study at the University then peruses relevant records to ascertain what her status is, and subsequently passes this information on to the third party. There of course may be subtle variations on this theme: perhaps the third party observed QF's presence and requested her friend to peruse the records. Perhaps an intermediary, who was a friend of the third party and also of employees working at the University, was involved with some type of request for information being passed from hand to hand. Clearly, on the evidence before the Tribunal this factual scenario is an inference that is open to the Tribunal. It has a certain cogency and is in accordance with common sense and the common conduct of human affairs at times like those under consideration. Sometimes people will simply do an improper act to help a friend who is in need, or is perceived to be in need. The evidence available puts such an inference beyond the realm of speculation, particularly given the firm way in which the letter of 07.09.04 is written as established fact rather than as mere speculation and enquiry. However, the critical question, whether other inferences are open or not, is whether the Tribunal should draw the inferences that the first applicant submits. Neither an astute observation nor a shrewd guess will suffice for this purpose, although either may well satisfy a listener during a social conversation, as they often do. 24 The first applicant was aware that the third party was acquainted with several persons who had a connection with the University and he submitted that it was through one or more of these acquaintances that the third party obtained QF's information (transcript 13.09.07 pages 63 ff). He further submitted that this information came from a perusal of the records that the respondent maintained concerning QF's student and personal affairs. In truth it may well be that these submissions are correct, but the Tribunal cannot speculate on this and must make factual findings, to the extent possible, on the evidence in the proceedings. There was quite some evidence on this point. It is set forth in detail in the submissions filed by the parties, particularly in the respondent's submissions filed in QF's proceedings (number 053179). Basically the first applicant suggested a network of persons having connexion with the University, with each other and with the third party through which the information about QF could have been obtained from University files and passed to the third party. Certainly the evidence is such that this suggestion is plausible and only a little evidence would be sufficient to show that it is correct. The respondent has dealt with this aspect by filing statements from one Maureen Platzer and one Linda Harris and has called them both for cross-examination. Both these persons were possible links in the chain of communication. 25 Whilst the respondent's evidence, in its final form, shows that a number of persons accessed QF's files at relevant times (see exhibits R 14 and 15), the only person of some interest developed in the applicant's submissions was Belinda Platzer, an employee of the University and the daughter of Maureen Platzer. 26 The Tribunal accepts the evidence given by Maureen Platzer. Mrs Platzer was is mother of the University employee, Belinda Platzer, who processed QF's files upon her return to studies in 2004 (exhibit R10(1)) and who accessed QF's files for this purpose (R14 and 15). Consequently, Maureen Platzer could have obtained information about QF from her daughter, who had access to QF's files. However, Mrs Platzer's has denied that this ever occurred. She also stated that she did not pass on any information concerning the two applicants to any person and that she did not know Linda Harris and the third party. Consequently, this aspect of the suggested network is not established, the Tribunal being satisfied that Mrs Platzer gave truthful evidence. 27 The witness Linda Harris was employed by the respondent for 30 years, having retired in 2002. She knew the first and second applicants as well as the third party. She maintained contact with the third party after her retirement. In her statement dated 10.10.06 this witness describes how she has assisted the third party in relation to her difficulties arising from her marriage and the frequency of contact she has had with the third party (see paragraphs 8, 9 and 10 of her statement). The Tribunal has no doubt that she would have assisted the third party if she was in a position to do so. She states that she did not request any employee of the respondent to obtain information about QF's studies or scholarship from University files (paragraph 15) and that she did not pass any such information to the third party (paragraph 12). However, she had extensive knowledge about graduate student matters, scholarships (including quantum) and absences of leave and she accepts that it is possible that she spoke with the third party about students returning to study after leave of absence (paragraphs 4, 5, 12 and 15). She also states that someone told her that they had observed the second applicant having coffee on campus and she believes that it is possible that she passed this information on to the third party (paragraph 14). The time when this occurred is not shown clearly in the statement. 28 In evidence Mrs Harris recalled that the quantum of scholarships was some $18,000, tax-free. She said that she recalled the different scholarships that the students with whom she dealt had. In cross-examination Mrs Harris said when she had been told that the second applicant had been seen on campus, if she had contacted the third party after that, she probably would have told the third party that the second applicant "was back on campus". This manner of expression suggests that Mrs Harris somehow had knowledge that the second applicant had returned to her research and this in turn suggests that if these events occurred, then they did so in the latter half of 2004. 29 In cross-examination Mrs Harris was asked a general question whether it was possible that someone (from Biological Sciences) had informed her that the second applicant had started her scholarship again (page 78). Mrs Harris' reply was: "You would have to give me a name from Biology". The question was asked generally and a simple reply could have been given, but it wasn't. Just after that Mrs Harris said: "Well, I can't think of anyone offhand at the moment". Also, Mrs Harris said in her statement that she did not enquire about the first applicant with a person by the name of Jackie Walsh (paragraphs 16 and 17), whereas in cross-examination on this point her evidence was that she did not believe that she did this (page 80.20 ff). 30 The second applicant during cross-examination gave quite extensive evidence relating to Mrs Harris (transcript 24.08.07 pages 41 ff). In essence it was said that Mrs Harris had in the past solicited information about the applicants and their affairs: the requests made of Jackie Walsh being one example and the fact that information given to Mrs Harris by the second applicant herself had subsequently turned up in affidavits filed by the third party in the litigation that was on foot. Other examples were stated as well. Whilst the second applicant was quite frank in her acceptance of the fact that she had no liking for Mrs Harris, there is sufficient in the second applicant's testimony to suggest that Mrs Harris may well have played a part in the scenario under investigation. It is more likely than not that she did, however what she actually did in this regard is not clear. 31 In its submissions the respondent points to evidence, which permit an inference to be drawn that the information about QF did not come from University files. The letter from Mr Long dated 01.10.04 suggests that the information was based upon personal observation of QF at the University campus. Also, the information as to the quantum of the second applicant's scholarship is shown in a general publication (exhibit R 14), as well as the distinction between full-time and part-time allowances, which may well explain the reason for the request in the letter dated 07.09.04 as to whether QF was engaged part-time or full-time. The respondent submits that this evidence is sufficient to at least raise the competing inference that someone at the University has observed QF's presence, perhaps on a number of occasions, and being aware that she has a scholarship and also being aware of the general publication referred to, has advised the third party that QF has resumed her research work and is being paid some $18,000 per annum. However, as Mr Long's letter of 01.10.04 cannot be regarded as reliable evidence as he had no direct knowledge of the circumstances asserted therein, the Tribunal is not of the view that the suggested inference is actually available to it upon this basis. It is no more than speculation on this evidence. It is true that Mr Long in his letter dated 01.10.04 speaks of the information being available in the public domain, and he may well have got this from his client. But equally, he may have discerned this from his conversation with Ms O'Brien on the date of his letter to her. The Tribunal cannot entertain the suggested inference as a possibility if the only basis is that it is stated to be a fact in Mr Long's letter of 01.10.04. 32 However, Mrs. Harris' evidence stands in a different category. Whilst the Tribunal doubts the veracity of her denials that she made no enquiries on behalf of the third party about QF's position it does accept those parts of her evidence which established that she had association with the third party, assisted her from time to time and had detailed knowledge about graduate student matters which she had acquired over her years of employment with the respondent. It is quite possible on this evidence that had she been informed that QF had returned to research she could have, and even would have, informed the third party that this had occurred. Her knowledge of student graduate matters could have been sufficient to provide the third party with the information that is contained in the letter dated 07.09.04 without having to access University files. Upon the evidence it would at least be open to the Tribunal to make findings along these lines, without engaging in improper speculation. Therefore this is a competing inference that is open on this evidence. 33 Where competing inferences are open there must necessarily be some evidence to show that one of the inferences is more likely than the other, or that it is the correct one to draw in the circumstances. A perusal of the evidence does not reveal any evidence whereby this choice may be made. Even the finding that more likely than not Mrs. Harris played a part does not suffice because there is really no evidence suggesting that Mrs. Harris, more likely than not, obtained the disclosed information about QF from university files. It is true that the second applicant gave evidence that she was an "invisible student", and that her scholarship status was not widely disseminated by her, and therefore it is unlikely, in her opinion, that people outside the University Administration would know that she had returned to studies and that she had, or still had, a scholarship. However, this was more an expression of belief rather than firm evidence which the Tribunal is able to rely upon (transcript 24.08.07 pages 44ff and 51). 34 There are two statements in the letter of 07.09.04 that deserve individual consideration. These are the statements in these terms: that the second applicant "has returned to her scholarship course" and "Our advice from the University is that (the second applicant) is receiving approximately $18,000 per annum for her research work". Both these statements demonstrate a knowledge (or belief) that the second applicant was the holder of a scholarship that related to research work. Both items of knowledge were in fact true. It is clear from the evidence that the fact she was a scholarship holder was not a matter of record that was made public. The second applicant gave evidence that her scholarship status was not widely known, outside University staff (transcript 24.08.07 pages 46 ff) and she gave reasons why she believed this to be so. She did accept that the terms of scholarships were made quite public and that in some special circumstances it may well become public that a particular student holds a scholarship (transcript 24.08.07 at page 52). However, in her case she did not even tell her husband that she had a scholarship (page 53). This evidence clearly supports the inference pressed by the applicants, however it does contain a degree of speculation and belief sufficient to deter the Tribunal from acting upon it. Facts such as there are not readily the subject of accessible proof. 35 Consequently, the Tribunal cannot, even by inference, safely make any findings of fact as to whether QF's information was obtained from University files nor can it make any findings of fact as to how this was done so as to ask whether the respondent should be held liable for the acts involved. A necessary part of the picture remains completely blank. The first respondent has presented the case for both applicants admirably and with precision, but even he has accepted at various times during the hearing the difficulty that the applicants face in proving the pathway whereby the information about QF was released (transcript 23.04.07 pages 10, 14, 19, 34 and 66; 24.04.07 pages 47 and 48). The position is simply that if the Tribunal is to reach a decision adverse to the respondent, it cannot speculate on the facts: they must be proved in a way that persuades the Tribunal that the factual conclusions it reaches are the correct ones to make. 36 Clearly for some reason enquiries have been intiated by or on behalf of the third party into the second applicant's then current position. The question is to determine what steps were then taken. To put the matter simply: the evidence shows two ways in which the information could have ended up in the hands of the author of the first letter: it could have come from a perusal of the university's records and it could have come from someone's knowledge that QF held a scholarship combind with a general knowledge as to what those scholarships entailed. Without evidence, which persuades the Tribunal that the former is correct, or more likely to be correct than the latter, the applicants arguments cannot succeed. There is no evidence that so persuades the Tribunal. 37 The inability of the Tribunal, on the evidence before it, to make these requisite findings of fact has two consequences. Firstly, it has not been established that the information about QF in fact was obtained by perusing her files that the University maintained. Secondly, the evidence does not establish any fact upon which it can be held that the respondent is responsible for the disclosure of information (following the reasoning in Director-General, Department of Education and Training v MT (2006) 67 NSWLR 237 at [43], [54] and [55]). Consequently the decision under review must be affirmed to this extent, albeit for different reasons. THE SECOND BREACH 38 The circumstances relating to this breach have been outlined above. A succinct review of this allegation will suffice. Whilst investigating the privacy breaches that had been alleged, Ms O'Brien spoke with Mr Long on 01.10.04 by telephone and revealed certain information about QF for the purpose of obtaining information from him. The conversation is set out in exhibits R7(1) and (2). The only information that Ms O'Brien disclosed in that conversation to Mr Long, which he already did not know, was the fact that the second applicant had lodged a privacy complaint. The second applicant's letter of complaint is dated 10.09.04 and is annexed to exhibit R7. This letter alerts the respondent to an alleged breach of privacy and requests that action be taken, specifically by taking preventative measures. Ms O'Brien was instructed by Dr Brian Spencer to contact the author of the letter dated 07.09.04 and ascertain how the information in that letter was obtained. Dr Spencer required this information to further his enquiries in follow up to the complaint. Obviously, if the circumstances whereby the information about QF had been obtained were revealed this would assist in determining any remedial action that the University should take. Clearly this was a reasonable step for the respondent's officers to take. However, the issue is whether it involved a breach of privacy. 39 Section 53 of the Act required the respondent upon complaint being made to undertake a review of the conduct brought into question. Clearly any such review must involve a determination, if possible, whether conduct has occurred in breach of the legislation for which either the respondent or one of its officers is responsible. It cannot comply with section 53(7) without taking this step. By advising Mr. Long that the second applicant had made a complaint under the privacy legislation Ms O'Brien has done no more than take a step that is made permissible by section 25(b) of the Act: the duty to review the conduct complained of necessarily carries with it an obligation to determine what that conduct in fact was. The complainant here did not have direct knowledge of the actual conduct and therefore it was for the respondent to take reasonable steps to find out what in fact was involved. For Ms O'Brien to advise Mr Long that she was pursuing a privacy complaint and therefore required the information sought is a step that is, at the least, reasonably contemplated by the privacy legislation itself and therefore falls within the exemption for which section 25(b) provides. 40 Further, the second applicant's letter of complaint encloses both letters from the third party's solicitors evidencing the alleged breach and asserts: "We strongly suspect this is a case of someone asking an old mate to look something up for them". In an email dated 09.09.04 following up this complaint the second applicant indicates that she wishes the University to ascertain "the source of the unauthorised release" (exhibit A2 annexure C). On this basis the letter of complaint impliedly gives consent to the type of step that Ms O'Brien took. For the same reasons sub-sections 18(1)(a) and (b) have application. Although the lodging of the complaint was not solicited by the respondent in this case, the making of the complaint under the legislation and the duty to review it are sufficient to satisfy the "collection" element in section 18(1)(a) and the second applicant may easily be seen as "reasonably likely to have been aware" that persons identified in her complaint would be, in the usual course, spoke to during investigation (so as to satisfy section 18(1)(b) of the Act). The respondent's submissions on this aspect set forth the reasoning process involved. 41 Consequently, the decision under review is affirmed to this extent. THE ADEQUATE SAFEGUARDS ISSUE 42 The statements made by the Assistant Registrar Suzanne Kelley outline the steps that the respondent has taken in relation to its obligations to ensure the privacy of personal information that it holds (exhibits R 14 and 15). These include undertakings by employees and electronic reminders of these obligations when personal records are accessed. They also include limiting access on a need to know basis. These are all reasonable measures. However, as a breach of section 12 of the Act is alleged, the question is whether there were steps that ought to have been taken, within reason, but which were not (NS v Commissioner of Corrective Services [2004] NSWADT 263). 43 The applicants point to two issues. Firstly they suggest that there is a deficiency in the training programs that are provided and secondly that there is no record kept when personal files are accessed simply for perusal (that is on a read only basis). There would obviously be a need for formal training if University staff readily provided personal information whenever requested during the course of their duties. But this is not the case here. 44 Given that only authorised officers have access to personal records it is most likely that increasing the measures by recording access on a read only basis would have a deterrent effect upon an officer making a covert enquiry of personal records for an improper purpose, that is, one that is outside the scope of their duties. Against this must be balanced the fact that the respondent has already restricted improper access, at least to a degree, in that only authorised officers may access such records. There is also the question as to whether recording, and therefore tracking at a later stage, read only access is practical. It appears to be a sensible step by way of deterrence, but only if it is practical and does not give rise to problems of a magnitude that the respondent does not wish to bear. Also, it may have greater significance in relation to particular information, such as scholarships, than it does to the record of courses studied and grades awarded. However, the Tribunal does not have the evidence before it with which to evaluate this possibility and it may well be that there is ample reason why the respondent has not implemented measures of this nature. Consequently, it would not be appropriate to place a burden on the respondent to investigate and implement this step by way of formal order in exercise of the Tribunal's powers. Whether it would assist the respondent in observing its duties under the legislation should be left to the respondent's own discretion. 45 Consequently, the decision under review is also affirmed in this regard. THE CORRECTION OF RECORDS 46 When these proceedings were commenced there were a number of corrections that the second applicant was seeking in relation to her academic record. Many of these were resolved prior to the hearing. However, three remain. Two corrections involved a claim that two grade recorded as "F/W" should in fact be simply "W", that is withdrawn rather than failed/withdrawn. Put summarily, the second applicant's evidence was that she had withdrawn from studies because of misadventure and she submitted that the record should simply show "W", representing a withdrawn outcome. The third claim alleges that an assessed "C" grade should in fact be a "B" grade. The evidence on this point is essentially that part of the course was impossible of completion and therefore, she argues, her grade should have been assessed only by reference to those parts of the course that were available for completion. The evidence was much more extensive than as outlined here. 47 These corrections that are sought concern subjects studied by the second respondent quite some years ago. It is not submitted by the second applicant that the grades as actually awarded are incorrectly recorded. Rather, her argument is that she should have been awarded other grades for the reasons that she has given. In essence she is seeking a review of the award process. The internal review mechanisms provided for in the University Bachelor Degree Rules (exhibits R2 and R3) were canvassed at length in submissions, however they do not have any material bearing on the issues under the legislation. 48 The Act requires the respondent to maintain records that are accurate, current and not misleading. The respondent has done this in relation to these three subjects in that it records the grades, or outcomes, that were in fact awarded, as the respondent correctly submits. The applicant's real argument on this point is not that the records are inaccurate or misleading, but that the grades awarded are wrong. The power conferred upon the decision maker, and upon this Tribunal, to amend incorrect records (relating to grades awarded) does not extend to re-assesing those grades, even though there may be good reason for arguing that the grades themselves are incorrect. 49 However, section 15 of the Act permits a person to seek alteration and, if a respondent does not make the alteration requested, to request that steps be taken to attach a statement concerning that information. If this be done, the section obliges the respondent, within reason, to attach a statement that comes within the requirements of the section. 50 As explained by the second applicant in evidence this aspect of the proceedings is of considerable significance to her, given the academic nature of the career she wishes to follow. That this would be so is quite clear in the circumstances. 51 The decision under review has not fully addressed these issues. With his decision letter of 31 March 2005, Professor Loxton enclosed a report of his review. That report notes the claim that the second applicant "has been unable to remedy errors in the records about her". He deals with this aspect with the finding that the second applicant was requested by letter dated 11.01.04 to make arrangements to access her records and, if necessary, amend her personal information. He then concludes that section 14 of the Act, which provides a statutory obligation to give access, has been complied with. It appears that he was then of the view that the records issues had been resolved, in the absence "of further evidence of difficulties". However, clearly this is not the case. 52 Whilst the decision maker does not expressly refuse to amend the records as requested it would be fair to say that implicit in the report is a decision, whether implied or by default, to the effect that the records will remain as they are. The respondent has conducted this matter upon this basis. For the reasons given above this is the correct decision. However, it is appropriate that this implied part of Professor Loxton's decision be set aside and that there be substituted an express determination that the records be not amended in relation to the three particular courses that have been the subject of argument in these proceedings. 53 Whilst this will resolve this aspect for the purposes of these proceedings it does not provide a final outcome for the dispute between the parties as to the application for amendment of the second applicant's records. The second respondent has two options. The first is to seek redress pursuant to the Bachelor Degree Rules, obtaining any necessary dispensations as to time limits that the respondent is willing to give. The second is to invoke the second leg provided in section 15 of the Act by making a request that an appropriate statement be attached to the relevant information. As this request has not yet been made it appears that this aspect was not before the original decision maker and therefore is not before the Tribunal. This aspect has not been addressed in submissions, nor as far as the Tribunal is able to discern, in the evidence. If either party is of the view that this is not the case, the parties are granted liberty to apply on 7 days notice to have the matter re-listed for directions to be given to set a date for the hearing of submissions in relation thereto, such liberty to expire 14 days after receipt of a copy of these reasons for decision. Otherwise it will be for the second respondent to determine whether she wishes to make a request that a statement by her be attached to the information in question. DEALY IN REACHING DETERMINATION ON INTERNAL REVIEW 54 This issue can be dealt with succinctly. From the second applicant's point of view it is true that these issues have been outstanding for many years. There are several reasons for this, including the misfortunes that both applicants have endured in the meantime. However, the question for the Tribunal turns on section 53 of the Act. The relevant chronology is set forth in the respondents submissions dated 23.11.06 and relevant documents appear as annexures to exhibit A2. 55 It is true that the communications between the parties over the issues under consideration spanned a considerable period of time. They started in September 2004 when the applicants first raised the disclosure issue stemming from the letter dated 07.09.04. A determination issued about this matter on 21.10.04 (exhibit A2, annexure L), but communications continued thereafter and additional matters were raised. The process culminated in March 2005 with Professor Loxton's determination covering all issues. Whilst overall this is a lengthy period the communications between the parties explain why this was so: issues were being raised and discussed and the parties were endeavouring to reach a reasoned outcome through dialogue. The time taken has been reasonable in the circumstances and the Tribunal so finds. INTERLOCUTORY MATTERS 56 During the course of these proceedings several issues of an interlocutory nature arose for determination. These applications were for summary dismissal, setting aside of summonses and prohibition orders concerning some items of evidence. As it turned out the respondent did not press for summary dismissal nor for the prohibition orders. The statements with respect to which the respondent initially sought prohibition orders (they are marked "confidential") were tendered eventually and full copies provided to the applicants. During the course of the hearing the Tribunal indicated that it proposed to set aside three summonses, for which reasons would be given in due course, and it granted leave to the applicants to issue a fresh summons to the proper officer of the University. The applicants later decided that they would not issue the fresh summons and the parties advised the Tribunal that they did not require reasons for setting aside the summonses. The applicants indicated that they would, in any event, withdraw those summonses. 57 Consequently there is no need to deal with these issues in these reasons for decision. COSTS APPLICATION 58 The respondent sought cost thrown away in relation to the early adjournment of the proceedings on 14.06.07. Costs were quantified. This application arose in the following way. 59 The hearing on 24 April 2007 adjourned early that day as the position had been reached that the proceedings could not be continued during the scheduled afternoon session. When adjourning the further hearing to 14 June 2007 the Tribunal noted that the respondent required QF for cross-examination at the next hearing and that, in the event that she was unable to do so by reason of ill-health or other misfortune, the applicants were to notify the respondent forthwith (transcript page 53). 60 On 14.06.07 the second applicant did not attend for cross-examination. She had given no prior notice to the respondent that she would not be attending. At the last hearing the respondent had sought such notice so that the listed hearing day could be re-arranged in the event of the second applicant's inability to attend (transcript 24.04.07 page 53). The first applicant explained that the reason for the second applicant's non-attendance was that she was to attend a medical appointment that day in relation to a serious illness, at which appointment she was anticipating receiving a diagnosis that could turn out to be very distressing. He added that the second applicant had been unwell for some time and that he had not fully appreciated the need for her to attend and therefore had not properly explained it to her. A person with legal training would not fail to appreciate the need for a witness to attend for cross-examination but it is plausible that QE could have been under such a misunderstanding. He further said that he had not attended to the responsibilities he had undertaken concerning the proceedings, filing submissions in the interim and the like, due to his own health and other misfortunes. Most likely he simply forgot about notifying the respondent that the second applicant would not be attending. The proceedings were then stood over for further hearing to 07 November 2007. The Tribunal accepts both QE and QF as credible witnesses. 61 The explanations proffered by the first applicant were not said by way of evidence upon oath or affirmation, although they were supported in part by the testimony of the second applicant, but rather by way of submission. The respondent was not offered the chance of cross-examining the first applicant on these statements, nor did it seek such an opportunity, and understandably so. This is not to be critical but to state the obvious: there was little that could be achieved in cross-examination in this regard without further extensive enquiries. However, despite the absence of cross-examination and formal oath or affirmation, the Tribunal is impressed with the veracity of the first applicant and has no hesitation in accepting his submissions in this regard, particularly given the evidence adduced by the second applicant which supports his contentions. This evidence by the second respondent is interspersed amongst her evidence on substantive issues. Consequently the first respondent has proffered an acceptable explanation for the second respondent's non attendance on the day. 62 The second applicant attended at the resumed hearing and was cross-examined by the respondent's counsel. Further evidence was also adduced that day, essentially by way of cross-examination of witnesses called by the respondent. Oral submissions were made as well that day. The Tribunal's decision was then reserved and directions were made for final written submissions. 63 The Tribunal may award costs in favour of a party but only where it is satisfied that there are special circumstances warranting the award of costs (section 88 ADT Act 1997). Ordinarily, in a court of law, if a party who has given evidence, in say the form of an affidavit, is aware that they are required to attend a hearing for the purpose of cross-examination, and they do not attend, there is a proper basis to award, to the other side, costs which are thereby thrown away. Such a failure is outside the ordinary procedures of court litigation. Even so, the awarding of costs still remains within the discretion of the court and other circumstances may well result in a court declining to award costs, despite the non-attendance of the party. Consequently, a court will enquire into, and take into account, explanations for the failure to attend. 64 Section 88 of the Tribunal's enabling legislation is also a discretionary power and is one which is conditioned upon the Tribunal being satisfied that there are special circumstances warranting the making of an award of costs (Gizah Pty Ltd v AXA Trustees Limited (No.2) [2001] NSWADT 164). Considering the outcome of these proceedings and the failure of the second respondent to attend, and weighing them against the explanations proffered by the applicants, the Tribunal is of the view that the circumstances, even though they involve a departure from the ordinary course of procedure in adversarial litigation, do not warrant an award of costs against either of the applicants. In addition, apart from this one instance the conduct of the applicants has been exemplary in the way they have managed these proceedings and they should not be penalised by a costs order for this single aberration. There are times when a party's proper conduct of proceedings should weigh in their favour, and this is one such time. 65 When considering a costs application the administrative nature of the proceedings is an important consideration. The Tribunal is not a court of law empowered to determine disputes between litigants. It is an administrative body whose functon is to determine disputes between subjects and departments of state and government instrumentalities. It acts as an administrative body in much the same the same way as the decision maker whose decision is under review: the difference of course being the Tribunal's independence. Section 88 of the Tribunal's enabling legislation embraces this position by conferring a power to only award costs in special circumstances. The Tribunal offers applicants the opportunity to obtain a determination by a body that is independent of the government instrumentality that made the intitial decision. The ability of applicants to come to this Tribunal and to prosecute their case should not be deterred by awarding costs where an applicant has failed to appreciate the significance of a procedural requirement. 66 Consequently the Tribunal declines to make the costs order sought by the respondent. This should not be taken to reflect adversely in any way upon the propriety of the respondent in making such an application: there clearly was a basis upon which it could be made. Orders In relation to proceedings 053179 (QF v Macquarie University): 1.The decision under review is set aside insofar as it considers the application made pursuant to section 15 of the Privacy and Personal Information Protection Act 1998 and a determination that the recorded grades or outcomes for courses EDUC 106, TEP 312 and TEP 333 remain as shown in those records is substituted therefore 2. The parties are granted liberty to apply for further directions, should they so wish, in relation to any request that is alleged pursuant to section 15 of the Act to attach a statement to information held by the respondent concerning any of these three courses, such liberty to expire 14 days after receipt of a copy of these reasons for decision. In relation to both proceedings: 3. Otherwise the decision under review is affirmed for the reasons given herein 4. The time taken by the respondent to determine the review was reasonable in the circumstances for the reasons given herein 5. No order is made as to the costs of the proceedings. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.