CITATION: GL v Director General, Department of Education & Training [2003] NSWADT 166 DIVISION: General Division APPLICANT PARTIES: GL RESPONDENT Director General, Department of Education & Training FILE NUMBER: 033026 HEARING DATES: 23/06/2003 SUBMISSIONS CLOSED: 06/23/2003 DATE OF DECISION: 07/11/2003 BEFORE: Hennessy N - Magistrate (Deputy President) APPLICATION: Privacy - information protection principle - contravention of - Privacy - privacy code of practice - contravention of MATTER FOR DECISION: Principal matter Administrative Decisions Tribunal Act 1997 LEGISLATION CITED : Education Teaching Regulation 2001 Occupational Health and Safety Act 2000 Privacy & Personal Information Protection Act 1998 CASES CITED: Y v Director General, Department of Education and Training [2001] NSWADT 149 APPLICANT In person REPRESENTATION: RESPONDENT D Galbraith, solicitor PRIVACY COMMISSIONER L Blamey, solicitor ORDERS: 1. The disclosure of the name, address, picture or any other material that identifies, or may lead to the identification of the applicant, or the doing of any other thing that identifies, or may lead to the identification of the applicant, is prohibited. ; 2. Pursuant to s 55(2) of the Privacy and Personal Information Protection Act 1998, the Tribunal finds that there has been no contravention of the PPIP Act and consequently has decided not to take any action on the matter. Introduction 1 The applicant in these proceedings has complained under Privacy and Personal Information Protection Act 1998 (PPIP Act) about the respondent's use of certain personal information about her. Given the applicant's concerns, it is important that the Tribunal does not disclose her identity. She is referred to in these reasons as "the applicant". In addition, I make the following order under s 75(2)(b) of the Administrative Decisions Tribunal Act 1997 (ADT Act): The disclosure of the name, address, picture or any other material that identifies, or may lead to the identification of the applicant, or the doing of any other thing that identifies, or may lead to the identification of the applicant, is prohibited. 2 Pursuant to s 55(7) of the PPIP Act, the Privacy Commissioner appeared in these proceedings. 3 The applicant was a teacher at a Central School who complained to the Director General, Department of Education and Training (the respondent) about its use of personal information about her. The information is contained in a letter and enclosures sent on 18 October 2000 by a District Superintendent to the Principal of another school to which the applicant had been referred (the new Principal). The letter was written by the District Superintendent and the enclosure was a report written by the Principal of the school where the applicant was teaching. 4 The background to these proceedings is that the applicant complained to the Principal of the Central School (the first Principal) about alleged stalking and harassment by a parent and harassment from staff members and the previous principal. In the course of making those complaints to the first Principal, the applicant disclosed that she was taking anti-depressants and using alcohol heavily. On 21 June 2000, two parents complained to the first Principal about the applicant's teaching methods and behaviour. The first Principal investigated these complaints by interviewing the parents and the applicant, among other things. A member of the Teachers' Federation and a support person were present at the meeting with the principal and the applicant which took place on 27 June 2000. The Principal outlined the details of the complaint to the applicant at that meeting. 5 On 29 June 2000, as a result of the District Office seeking procedural advice from the Industrial Relations Service (IRS), the matter was registered with the IRS as an active "inefficient/incompetent" case which was allocated to Mr Bender. I mention Mr Bender's name because I do not believe that it will lead to the identification of the applicant. The role of the IRS was to provide procedural advice to the District Superintendent on the applicant being placed on alternative duties and referred to Healthquest. Mr Bender recommended that the applicant be directed to perform alternative duties pending the outcome of an assessment by Healthquest of her fitness for duty. 6 An officer from the District Office advised the first Principal that Mr Bender had suggested that he prepare a risk assessment of the applicant given the apparent safety concerns for students, staff and the applicant. The first Principal prepared a report entitled "Results of Investigation into Complaint" and forwarded a copy to Steve Bender at IRS. The Principal suggested that his report may be relevant to any new position with the respondent which the applicant might occupy. 7 On 29 September 2000 Mr Bender was advised that the applicant had been transferred to another school. On 5 October 2000, Mr Bender advised an officer from the District Office to send a copy of the first Principal's report to the applicant's new Principal. The report was sent with a covering letter form the District Superintendent. The applicant complained about the information in the report and the fact that it had been sent to her new Principal. The applicant is no longer working at the second school. Jurisdiction 8 Several issues arose in these proceedings concerning the Tribunal's jurisdiction to review the conduct in which the respondent had allegedly engaged. Section 55(1) of the PPIP Act is the source of the Tribunal's jurisdiction to hear applications under that Act. That section states that: (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53. 9 Section 53 states, so far as is relevant to these proceedings, that: 1) A person ("the applicant") who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. 10 In this case, the applicant's application under s 53 specified "breaches of privacy and concerns over professional ethics regarding [the District Superintendent's] actions in sending certain documents to my former Principal in October 2000 while I was on a rehabilitation program." The applicant alleged certain breaches of the respondent's Privacy Code of Practice, as follows: Information Protection Principle No 9 refers to checking information for accuracy and relevance and checking that it is up to date and not misleading. This must be done prior to use and compliance is mandatory. [The District Superintendent] failed to comply with this as evidenced by the inaccuracies, irrelevancies and misleading statements in [the first Principal's] report, which he passed on to [the new Principal]. Information Protection Principle No 12 places special restrictions on the disclosure of information relating to health. [The first Principal's] report makes inappropriate and misleading comments concerning my health and [the District Superintendent] has passed this on to [the new Principal]. Information Protection Principle No 11 places certain limits on the disclosure of information. Of relevance here is 'unless related to the purpose for which it was collected." The information was purportedly collected to deal with a parental complaint, not to slander and try to discredit a member of staff. 11 The Privacy Code of Practice applicable to the respondent was not promulgated until 22 December 2000. Since the conduct about which the applicant complained occurred on or prior to 18 October 2000, it was not covered by the Code of Practice. However, the respondent conceded that the application for review of its conduct should be interpreted as applying to the equivalent Information Protection Principles (IPPs) in the PPIP Act. The equivalent IPPs are contained in sections 16, 18 and 19 of the PPIP Act. In her application to the Tribunal, the applicant alleged that the respondent had contravened sections 10, 11, 12 and 17 of the PPIP as well as sections 16, 18 and 19. 12 Following the applicant's application for review, the respondent reviewed its conduct and come to the following conclusions: 1. It was not possible to apply the Department's Privacy Code because that Code was not approved until 22 December 2000. 2. The information in the document contained information about an individuals' suitability for appointment or employment as a public sector official and by reason of s 4(3)(j) was not personal information. 3. Because provision of the report was authorised by Cl 10 of the Education Teaching Regulation 2001 and s 8 of the Occupational Health and Safety Act 2000, s 25 of the PPIP Act means that there was no breach of the IPPs that the applicant had alleged had been contravened. 13 These conclusions were modified and enlarged by counsel representing the respondent at the hearing. Each of the respondent's submissions as to why there has been no breach of the PPIP Act is dealt with below. Privacy Commissioner's Directions 14 Under s 41 of the PPIP Act the Privacy Commissioner may direct that a public sector agency, such as the respondent, is not required to comply with a specified information protection principle. Any such direction has effect despite any other provision of the PPIP Act. That provision commenced on 1 June 1999 and on 27 June 2000 the Privacy Commissioner directed that the respondent is exempt from the IPPs in sections 9, 10, 12, 13, 14, 15, 17, 18 and 19 until 30 September 2000. The Privacy Commissioner made further directions on 1 October 2000 and 31 October 2000 which meant that the respondent was exempt from complying with those IPPs until 31 December 2000. As the alleged conduct occurred on or before October 2000, the Tribunal does not have jurisdiction to review any conduct so far as it alleges a breach of those provisions. That leaves the IPPs in s 11 and 16 to be considered. Section 11 15 Section 11 states that: If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: (a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 16 The respondent made two submissions in relation to the applicant's reliance on s 11 of the PPIP Act. The first submission was that the Tribunal lacks jurisdiction to entertain such an application because it was neither express nor implied in her application for review that she was relying on that provision. The Privacy Commissioner and the applicant disagreed with that submission. 17 The respondent's alternate submission was that s 11 relates to the "collection" of information and all the relevant information was collected prior to 1 July 2000 when the substantive provisions commenced. The applicant disagreed with this submission. Express or implied nomination of breach 18 Section 53(1) entitles a person to apply to an agency for a review of certain conduct. Section 53(2) sets out the manner in which an application must be made. (1) A person ( "the applicant" ) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. 19 No other requirements are prescribed by the regulations. 20 The respondent submitted that an internal review must be of "conduct" as defined in s 52(1). Section 52(1) states that: (1) This Part applies to the following conduct: (a) the contravention by a public sector agency of an information protection principle that applies to the agency, (b) the contravention by a public sector agency of a privacy code of practice that applies to the agency, (c) the disclosure by a public sector agency of personal information kept in a public register. (2) A reference in this Part to conduct includes a reference to alleged conduct. (3) This Part does not apply to any conduct that occurred before the commencement of this Part. 21 The respondent submitted that as a matter of construction this provision requires that to be a competent application for internal review, an application must identify either expressly or by implication, a breach which falls within s 52(1). It is not sufficient, according to the respondent, to allege a breach of privacy in general terms or a breach of Part 2 of the PPIP Act. The application must allege a breach of an information protection principle. 22 The applicant maintained that she had identified s 11 in her application for review because she had mentioned s 16 (being the equivalent provision of IPP 9 in the Code of Practice) and s 16 and s 11 overlap significantly. Despite some similarities in the words used in s 11 and s 16, they are entirely different sections addressing different purposes. Section 11 relates to the collection of personal information whereas s 16 relates to the use of that information after it has been collected. I find that the applicant did not expressly or impliedly allege that the respondent had breached s 11 in her application for internal review. 23 The Privacy Commissioner disagreed with the respondent's submission that specific IPPs must be mentioned in the application. The Privacy Commissioner pointed out that under s 55(1) an application to the Tribunal is for a review of the conduct that was the subject of the application. There is no express requirement in s 53 or elsewhere in the PPIP Act, to identify the alleged breach. According to the Privacy Commissioner, it is up to the Tribunal to determine whether the conduct that is the subject of an application under s 53 is conduct to which s 52 applies. 24 The Privacy Commissioner relied on remarks by the Tribunal in Y v Director General, Department of Education and Training [2001] NSWADT 149. In that case, the applicant's union had written a letter to the respondent requesting amendment to a document and immediate withdrawal of the threat to transfer the applicant. The letter asks for a response within 7 days 'or the Association will have no alternative but to seek the assistance of the Industrial Commission to resolve the issues.' The Tribunal concluded that the agency was entitled not to regard the letter as an application for internal review under the PPIP Act. The Tribunal concluded at [16]: In reaching this view in this case, I should make it clear that I do not see it as essential that there be express reference in correspondence with agencies to the statute under which application is made. There will be cases where it is apparent from the surrounding context, such as oral interactions between the applicant and the agency, or the internal contents of the letter, that a statutory right is being invoked. But in cases where an applicant proceeds through an informed agent (such as a legal practitioner or a union) it is reasonable for an agency ordinarily to expect to find a direct reference to any statutory right that is being invoked. 25 The Tribunal's conclusion in this case is that it is not always necessary for an unrepresented person to refer to the legislation under which an application is being made. It can be implied from this comment that the Tribunal's view would have been that an express nomination of the statutory provision on which the applicant relies, is not required. 26 I agree with the Privacy Commissioner's submissions that 52(1) merely sets out the kinds of conduct to which s 53 applies. While the conduct listed in s 52(1) is the only conduct that the agency or the Tribunal can review, there is no express or implied requirements for an applicant to identify the precise contravention on which he or she relies. If the contravention is not specified, it is up to the agency, or the Tribunal, to identify the relevant contravention with the assistance of the applicant. Apart from rejecting the respondent's submission as a matter of statutory construction, there are compelling practical considerations for rejecting it. Applicants will not normally have the benefit of legal advice and it is unrealistic in many cases to require them to interpret and apply statutory provisions. While I acknowledge that it may be difficult for a respondent to review conduct without knowing which provision has allegedly been contravened, this can be addressed by discussing the matter with the applicant. Alternatively, the respondent may be able to anticipate from all the circumstances of the case, the nature of the alleged breach. 27 Based on this reasoning, the respondent's submission that the Tribunal has no jurisdiction to review conduct constituting an alleged breach of s 11 (because the applicant did not specify s 11 or its equivalent in her application) is rejected. Collection of information 28 The respondent's second submission in relation to s 11 was that the relevant information was "collected" by the respondent prior to the commencement of the relevant provisions of the PPIP Act on 1 July 2000. Section 20(3) of the PPIP Act states that: (3) Sections 8–11 do not apply in respect of personal information collected by a public sector agency before the commencement of this Part. 29 Section 52(3) provides that Part 5 of the PPIP Act (sections 52 to 56) does not apply to any conduct that occurred before the commencement of that Part. Part 5 commenced on 1 July 2000. 30 The evidence from the first Principal was that he collected information from the applicant and others who were involved, prior to 30 June 2000. The applicant agreed that she did not meet with the first Principal in relation to the complaint by the parents after that date, but said that the information was "collected" on 8 September 2000, which she says was the date of the report. The applicant submitted that it was not just the collection of the information but also subsequent inquiries of other officers and the collation of the report generally which constitutes "collection". 31 The Macquarie Dictionary 3rd edition, The Macquarie Library, defines "collect" as "to gather together; assemble". 32 I find, and the Privacy Commissioner agreed, that all information contained in the report about which the applicant complained, was "collected" or "gathered together" prior to 1 July 2000. The uncontroverted evidence of the first Principal was that he prepared the report entitled "Result of Investigation into Complaint" on 28 June 2000 and forwarded a copy to the District Office on 29 June 2000. On 8 September he forwarded a copy to Mr Bender at the IRS in response to his request. In those circumstances it cannot be said that any information contained in the report was "collected" after 30 June 2000. Consequently, the Tribunal cannot review the alleged conduct insofar as it alleges a breach of s 11 of the PPIP Act. Section 16 33 The final provision on which the applicant relied was s 16. That section provides that: A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 34 The respondent conceded that the Tribunal has jurisdiction in relation to any conduct involving a breach of s 16 but made three alternative submissions in relation to the applicability of that section. The first submission was that the information was not "personal information" because it comes within the exemption in s 4(3)(j), namely information or an opinion about an individual's suitability for appointment or employment as a public sector official." Secondly, the respondent did not "use" the information because it merely sent it by facsimile to the principal of a school who did not read it. Furthermore, the District Superintendent did not indicate any use to which the report should be put. Alternatively, the respondent maintains that it has taken such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate up to date and not misleading. Suitability for appointment or employment 35 Section 4(1) of the PPIP Act defines "personal information", relevantly, as follows: (1) In this Act, "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 36 Section 4(3) excludes certain information from this definition including: (j) information or an opinion about an individual's suitability for appointment or employment as a public sector official 37 The respondent submitted that although the document was overtaken by subsequent events, namely an assessment by Healthquest in relation to the applicant, the purpose of the document was to provide background information about the applicant to the principal of the school to which she had been transferred. 38 The applicant submitted that the document did not contain any information about her suitability for appointment or employment as a public sector official, because Healthquest had already found her to be fit for work. 39 The background to the preparation of the document was that Mr Bender requested the first principal to conduct a "risk assessment" of the applicant given the apparent safety concerns for students, staff and the applicant herself. After forwarding a copy of the report to the District Superintendent and Mr Bender, an officer from the District Office wrote to Mr Bender, advising him that the document had been received. The officer commented in his email that "HQ finds her fit as a teacher but recommends that she does not return to (name of town deleted)" On receiving this email, Mr Bender advised the officer that it would be appropriate to provide a copy of the document to the new Principal "to finalise this matter." 40 On the basis of this evidence, it is apparent that the document is a report resulting from an investigation into a complaint against the applicant. When the matter before the IRS had been finalised, the report was sent to the applicant's new Principal for his information. The content of the document and the context in which it was provided lead to the conclusion that the applicant's suitability for appointment or employment was not a live issue. Healthquest had already assessed the applicant as fit to teach and her suitability for appointment or employment was not in question. Consequently the respondent' submission that the information in the document is not "personal information," because if falls within the exception in s 4(3)(j), fails. Use of the information 41 The respondent's second submission in relation to s 16 was that it did not "use" the information in the report because it merely sent it by facsimile to the principal of a school who did not read it. Furthermore, the District Superintendent did not indicate that the report should have a particular use. The Privacy Commissioner disagreed with that submission maintaining that the use of the information is the act of sending it by facsimile to the new Principal and that whether he read it or not is irrelevant. 42 The ordinary meaning of the word "use" as defined in the Macquarie Dictionary, 3rd edition, Macquarie Library, is "to employ for some purpose, put into service; turn to account." In this case the respondent sent the information for the purpose of finalising the matter, no doubt because it was considered to be a relevant document for the new Principal to have as part of his records. The fact that the new Principal did not read it, and that the District Superintendent did not specify an intended use for the report, does not mean that it was not employed for a purpose. Consequently, the respondent has used the information as provided by s 16. Reasonable steps 43 The respondent's final submission was that even if the information is personal information that it used, they have taken such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. According to the respondent, the circumstances were that the document was provided "for information" as the matter with the IRS had been finalised. The covering letter to the document also acknowledged that the applicant had settled in well and "is a benefit to you and your staff." The purpose for which the document was conveyed, according to the respondent, was not that it was an up to date assessment, but in an effort to provide the new Principal with background information of what had occurred in relation to the applicant. In the respondent's view there were no other steps which the first Principal could reasonably have taken at that time. 44 The applicant submitted that the respondent should have consulted her and obtained her side of the story before using the information. In addition, the District Superintendent should have written in the covering letter to the document that Healthquest had now assessed her as being fit for work. 45 I accept the respondent's submission that the document was provided "for information" or as background material as the matter with the IRS had been finalised. ." I also agree that the purpose for which the document was conveyed was not that it was an up to date assessment of the applicant, but in an effort to provide the new Principal with background information. 46 The respondent interviewed the applicant on 27 June 2000 and outlined the allegations in the complaint. The content of the document set out the results of the investigation into the complaint. The respondent had already taken reasonable steps to ensure that the report was, accurate, up to date, complete and not misleading. In my view it was not necessary, in order to comply with section 16, for the respondent to consult with the applicant before sending the report to her new Principal. Reasonable steps had already been taken in relation to the content of the report and its purpose was not to provide an up-to-date assessment of the applicant's fitness for employment. 47 For the same reasons, it was not reasonable in all the circumstances for the District Superintendent to point out to the new Principal in the covering letter that Healthquest had now assessed her as being fit for work. Conclusion 48 Having reviewed the conduct about which the applicant complained, I find that there has been no contravention by the respondent of an information protection principle or privacy code of practice with which it was obliged to comply at the relevant time. Consequently I have decided not to take any action on the matter. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.