CITATION: RD v Department of Education and Training [2005] NSWADT 195 DIVISION: General Division APPLICANT PARTIES: RD RESPONDENT Department of Education and Training FILE NUMBER: 053017 HEARING DATES: 14/06/2005 SUBMISSIONS CLOSED: 06/14/2005 DATE OF DECISION: 08/19/2005 BEFORE: O'Connor K - DCJ (President) APPLICATION: Privacy - information protection principle - accuracy MATTER FOR DECISION: Principal matter LEGISLATION CITED : Privacy & Personal Information Protection Act 1998 CASES CITED: APPLICANT REPRESENTATION: In person RESPONDENT Dr A Bendall, Manager, Freedom of Information and Privacy, Department of Education and Training ORDERS: The Tribunal orders the Respondent to take the following action:; 1. The head of Department (the Director General) render a written apology to the applicant for the breach, and advise him of the steps to be taken by the Department to minimise the possibility of a similar breach in future; 2. Pay damages of $2000 to the applicant; 3. The Occupational Health and Safety Unit implement the following administrative procedures in connection with correspondence to officers who are referred to attend for HealthQuest or similar medical examinations, any variation of these procedures only to occur if approved by the Office of Privacy Commissioner: ; (a) verify addresses from the file rather than relying on individual documents; (b) mark envelopes 'Confidential'; and; (c) use registered mail, except where the addressee has given a specific authorisation orally or in writing allowing the mail to be sent through the ordinary mail. REASONS FOR DECISION 1 This is an application for review of the conduct of a public sector agency, made pursuant to the Privacy and Personal Information Protection Act 1998 (the Privacy Act). The applicant is a teacher employed by the respondent Department. As required by s 53 of the Privacy Act, he first made his complaint to the respondent Department. The Department investigated it. The Department's internal review report dealt with two items of conduct. In relation to the first item, the Department acknowledged a contravention of the Privacy Act. As to the second item, it found no contravention. Where there is a contravention, the agency must then decide whether it should take any action. 2 The application before the Tribunal is confined to the first item. 3 As at December 2003, the applicant had been on extended sick leave for some time. The Department decided to obtain advice as to whether he was able to return to duty. Consequently it made a request to the government health service, HealthQuest, for him to be assessed. The practice is that HealthQuest advises the employee by mail as to the date for the appointment; and the agency separately provides the employee with the medical history and other information that it has supplied HealthQuest. In this instance the applicant did not receive either communication. The Department found in its internal review report that the request for services form had misrecorded the address held on file for the applicant which was the correct address. As a result the mail went to '57' in the street where he lived rather than '76'. 4 At para [27] of the internal review report, the author (Mr John Murn, R/Director, Legal Services, report dated 15 December 2004) concluded that: '[B]y sending the information to an incorrect address due to an error in completing the form, the Department had not taken all reasonable steps to ensure that the information was accurate. There was therefore a breach of section 16 of the Act.' 5 Section 16 of the Privacy Act provides: ' 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.' 6 Section 52 provides that Part 5 of the Act (ss 52-56) applies 'to the following conduct: (a) the contravention by a public sector agency of an information protection principle that applies to the agency'. 7 If there is a contravention found, the agency must then consider what 'action' should be 'taken' by it. It is open to the agency to decide to take no further action. In this instance, the author of the report stated: ' Action Proposed 28. I recommend that Corporate OH&S Support Unit remind its staff members of the importance of complying with the Act and of checking the accuracy and relevance of personal information before using it. 29. Fortunately it does not appear that the breach of privacy had significant adverse consequences for [the applicant]. Accordingly I do not recommend that the Department take any further action in relation to it.' 8 It is this aspect of the decision that the applicant brings before the Tribunal, exercising his right to apply for review of the conduct of a public sector agency under s 55 of the Act. Section 55, as relevant, provides: '(1) If a person who has made an application for internal review under section 53 is not satisfied with: … (b) the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53.' 9 The applicant was most indignant over the statement in [29] of the report that he had not suffered any 'adverse consequences'. The applicant seeks an apology and damages of $2000. As to the awarding by the Tribunal of damages, s 55(2)(a) provides: '(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct'. 10 Relevant to this case is sub-s (4)(b) which provides: '(4) The Tribunal may make an order under subsection (2) (a) only if: … (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.' 11 The applicant did not know that he was due to be assessed by HealthQuest until that office called him on the day of the appointment (23 February 2004) to confirm the appointment. 12 On that occasion, the applicant said that he advised the contact person that he had not received any HealthQuest documentation, as he would have expected. He said the officer informed him that she would contact the responsible officer in the Department (Mr Ailwood) and arrange a new date. He still did not receive any documentation, with the result that he first saw it when he attended on 23 March 2004. The psychologist, Mr Stamboulliah, showed him the documents. 13 He felt that he was placed at a disadvantage by not having had prior access to those documents. 14 He contacted the Department and discovered that the wrong street number had been put on the request for services form. He said that he then called on the occupants of the other street number. A woman living there (who was also a teacher), told him that she recalled Departmental correspondence addressed to him, and had marked the envelope 'not known at this address' and returned it. He was worried, nonetheless, that the letter might have been opened and the contents of the letter might have been perused. (a) Apology 15 As to the question of rendering to the applicant a formal apology from an appropriate senior officer of the Department, perhaps the head of Department, no substantial explanation was given at hearing to the Tribunal by the Department as to why this could not be done. (b) Damages 16 At hearing the Tribunal asked the applicant to explain the context that had given rise to his health problems. His account was not contested by the Department. 17 As at 1998 he was aged approximately 38 years, and was a senior teacher in mathematics at a high school. He was the subject of rumour and gossip within the school to the effect that he had engaged in sexual activities with boys attending the school. With his consent, the Department decided to move him to a different school in the general region. The rumour and gossip followed him there. The stress led to him going on long-term sick leave. 18 In a written submission to the Tribunal he said: '1. By sending the information to the incorrect address and subsequently not redirecting the same information to me, I was unable to peruse vital information relating to my HealthQuest assessment prior to my appointment in April 2004. The Department of Education and Training had three and a half months to remedy this mess but nothing was done. Leading up to the assessment I was deeply anxious as I believed the Department of Education and Training were plotting to have me discharged medically unfit. By withholding this information I believed that their goal would be further enhanced. I couldn't sleep, I ate excessively and became very aggressive towards my family. I attended the HealthQuest assessment and was given my first access to the abovementioned documentation whilst being examined by psychologist Dr Stamboulliah. By being denied access to these documents I was not given any information to prepare a defence or attack from. 2. The aftermath of the HealthQuest debacle was that I realised that my paperwork had been sent to 57 … and not 76 …. The realisation now became apparent that other people had access to my personal and confidential information. I became very anxious and also depressed. What else may have been forwarded to wrong addresses? Who else has been privy to my confidential information? My psychological injury for which I was being treated for worsened over this period and has not in my opinion progressed due to this constant uncertainty and suspicion which is now part of my daily existence. My weight has increased by 20 kilograms, my sleep patterns are spasmodic, libido almost non-existent and anger and tolerance levels are very high and very low respectively. In conclusion may I also state that [the Department officer's] unqualified medical statement regarding what effect this incident has had on me just 'adds salt to an already well and truly open wound'.' 19 There was no explanation offered by the Department at hearing as to why the problem that the applicant had identified on 23 February – non-receipt of documentation – was not followed up either at HealthQuest or by the Department. 20 In accordance with directions the applicant filed a report from his psychologist (he has been in receipt of regular counselling and psychological assistance for some time), Dr Steven Dragutinovich BA Hons MPsych Ph D, Clinical and Consulting Psychologist and member of relevant professional associations. The Department was given the opportunity to have the applicant separately assessed, but decided not to take up that opportunity. It also did not require the psychologist for cross-examination. 21 The medical report is dated 15 February 2005, and refers to the observation in the internal review report, already quoted, finding that the breach of privacy did not appear to have had significant consequences for the applicant. 22 The medical report continued: 'At the time, I was still treating [the applicant] for Adjustment Disorder with Mixed Anxiety and Depression and I am in a position to refute [the agency officer's] unqualified and unsubstantiated statement as I observed exacerbated anxiety in my patient which further significantly sensitized his work related psychological injury. In my opinion, [the agency's] negligence impacted adversely on [the applicant] insofar as it exacerbated pre-existing work related anxiety. He remains anxious as he has no clear information as to who has been privy to his confidential information and the whereabouts of the original correspondence. This is continuing to cause [the applicant] significant apprehension which has been counter-therapeutic to progressing his work-related Adjustment Disorder syndrome. Until this issue is resolved satisfactorily I expect it will continue to compromise [the applicant's] rehabilitation.' 23 At the hearing on 14 June 2005 Dr Anthony Bendall, Manager, Freedom of Information and Privacy, with the Department appeared on its behalf. In response to questions from the Tribunal, he indicated that action had been taken to follow up the recommendation contained in the internal review report. The Tribunal asked him to provide evidence as to what steps were in fact taken. 24 By letter dated 27 June 2005 he advised that he had, soon after receipt of the internal review report, drafted a letter of advice to the occupant of the position Director, Occupational Health and Safety, the unit responsible for the misaddressing that had occurred. He had now discovered, contrary to his understanding, that the letter had never been sent. The letter was redrafted to bring it up to date, and was sent the day following the hearing, on 15 June 2005. 25 The letter refers to the internal review report and to the recommendation for action. It states: 'Please find herewith a copy of a decision arising from a privacy internal review conducted pursuant to section 53 of the Privacy and Personal Information Protection Act 1998 . I apologise for the delay in forwarding a copy to you. It had been intended to do so at the time the decision was made, but due to an oversight this did not occur. I would draw your attention in particular to Paragraph 28 on Page 5, which recommends that "the Corporate OH&S Unit remind its staff members of the importance of complying with the Act and of checking the accuracy and relevance of personal information before using it." While it is ultimately a matter for you as to whether you adopt this recommendation, among the measures I would suggest that staff be reminded of or encouraged to adopt are: verifying addresses from the file rather than relying on individual documents, so as to minimise transcription errors; marking envelopes "Confidential"; and using registered mail. I am also more than happy to assist in providing specific privacy training for staff who handle similar referrals, particularly if there is an upcoming conference or meeting of relevant staff that I could address. I recall having spoken to meetings of Staff Welfare Officers (as they then were) previously about privacy issues. If you wish to discuss this, please feel free to contact me on ……………, by fax on …………….. or by e-mail at …………………….. Yours sincerely Dr Anthony Bendall Manager, Freedom of Information and Privacy 15/06/05' Assessment 26 This case arises from a very simple clerical error. The Department, to its credit, has acknowledged the error, and that, in the circumstances, it constituted a failure to meet the standard set by s 16. 27 The need for address accuracy is particularly important when correspondence of great sensitivity is being handled. There can be no doubt that correspondence bearing on the health of employees and involving attendances for medical assessments, with the well-understood possibility that the assessment might give rise to steps to require a return to duty or terminate employment, is of a highly sensitive kind. Therefore great care must be shown in ensuring that address information is accurate. 28 The recommendation contained in the internal review report addresses the conduct of the staff of the Department, and sees that as adequately managed for the future by reminding them to be careful in their recording and transcription of addresses. 29 It is clear from the order-making powers given to the Tribunal that the legislature was not only concerned with providing relief that went to remedying the conduct of the Department for the future, but also was concerned to allow for personal redress being given to the applicant: see order (a) (damages); and (e) (requiring the Department to take specified steps to remedy any loss or damage suffered by the applicant). The Tribunal is also given the power to make '(g) such ancillary orders as the Tribunal thinks appropriate'. 30 In this instance the preconditions to an award of damages have been satisfactorily met. 31 The Tribunal is satisfied, in terms of the requirement of para (b) of sub-s (4) of s 55, that 'the applicant has suffered … psychological … harm, because of the conduct of the public sector agency'. The report of Dr Dragutinovich suffices in that regard. 32 Equally it is clear that this error is only one factor contributing to the state of the applicant's present psychological condition. The gossip and rumour to which he referred at hearing was, it would seem, the major source of the psychological harm that he has experienced in recent years. On the other hand, the Tribunal accepts that he would have been, as he suggests, quite apprehensive in the lead-up to a HealthQuest interview, and the non-resolution of the problem once it became known on 23 February 2005 exacerbated his psychological condition. The Department's evidence did not explain why once the letter had been returned 'not known at address' (the internal review report refers to a Departmental officer's recollection of this problem – paras 12 and 13), some follow-up action was not taken. 33 It may be that in circumstances of this kind, where it would appear that the error was not remedied at the first point at which it could reasonably have been identified as having occurred, some punitive component should be incorporated into the damages award. The Tribunal will not explore that issue any further on this occasion. 34 The applicant's claim for damages is a modest one. There is sufficient evidence here to support an assessment of $2000 for psychological harm. 35 In addition to making orders for damages, the Tribunal also has power under s 55(2) to make the following orders: '(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: … (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate.' 36 Apart from requiring an apology, and the payment of damages, it is also desirable to make an order as to future administrative procedures, along the lines suggested by Dr Bendall. Dr Bendall's suggestion was: That the following administrative procedures be implemented by the Occupational Health and Safety unit in connection with correspondence to officers who are referred to attend for HealthQuest or similar medical examinations: (a) verify addresses from the file rather than relying on individual documents; (b) mark envelopes 'Confidential'; and (c) use registered mail, unless the addressee has given a specific authorisation for the mail to be sent through the ordinary mail. 37 The steps recommended by Dr Bendall in his letter to the officer in charge of the Occupational Health and Safety unit are to be commended. They go beyond the very weak recommendation contained in the internal review report, and involve measures which should prevent a recurrence of this problem in the future. He has sought through his recommendations to introduce a regime of communication of sensitive correspondence closer to formal service of documents. 38 It is possible that there may be some element of impracticability or difficulty with these procedures that the Tribunal may not appreciate. As these possibilities only came to the notice of the Tribunal via Dr Bendall's letter following the hearing, the Tribunal has not had the opportunity to discuss them more fully with him or the Department. 39 In the Tribunal's opinion, rather than reconvene the Tribunal to discuss administrative matters of this kind and detail, the better option is to include a clause in the orders permitting the measures that commend themselves to the Tribunal to be varied by the Department, if approved by the Office of Privacy Commissioner. 40 It will be seen that the Tribunal has in its order set out below introduced a qualification into the registered address element of Dr Bendall's proposal (item (c)). There is some cost to agencies and inconvenience to addressees with registered mail arrangements, though clearly they offer a heightened guarantee to the addressor that the mail will reach the right person. The downside for the addressee is that it may require the addressee to attend a post office when that may not be convenient, and it may involve for some addressees a concern about their being seen as having a problem by people working at the post office. There would, the Tribunal thinks, be many persons who would be happy to receive the kind of sensitive mail this case concerns through the ordinary post. Orders The Tribunal orders the Respondent to take the following action: 1. The head of Department (the Director General) render a written apology to the applicant for the breach, and advise him of the steps to be taken by the Department to minimise the possibility of a similar breach in future; 2. Pay damages of $2000 to the applicant; 3. The Occupational Health and Safety Unit implement the following administrative procedures in connection with correspondence to officers who are referred to attend for HealthQuest or similar medical examinations, any variation of these procedures only to occur if approved by the Office of Privacy Commissioner: (a) verify addresses from the file rather than relying on individual documents; (b) mark envelopes 'Confidential'; and (c) use registered mail, except where the addressee has given a specific authorisation orally or in writing allowing the mail to be sent through the ordinary mail. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.