NR and NP v Roads and Traffic Authority [2004] NSWADT 276

CITATION: NR and NP v Roads and Traffic Authority [2004] NSWADT 276 DIVISION: General Division APPLICANTS PARTIES: NR and NP RESPONDENT Roads and Traffic Authority FILE NUMBER: 043055 HEARING DATES: 1/09/2004 SUBMISSIONS CLOSED: 09/01/2004 DATE OF DECISION: 12/01/2004

BEFORE: O'Connor K - DCJ (President) APPLICATION: Privacy - information protection principle - disclosure to third party MATTER FOR DECISION: Principal matter LEGISLATION CITED : Administrative Decisions Tribunal Act 1997 Privacy & Personal Information Protection Act 1998 CASES CITED: APPLICANT REPRESENTATION: In person RESPONDENT R Nathans, solicitor ORDERS: 1. A contravention of s 18(1)(a) is established; 2. The applicants' application for an order for monetary compensation pursuant to s 55(2)(a) of the Privacy and Personal Information Protection Act 1998 is dismissed; 3. Application to be relisted for planning meeting as to remaining matters (any other order; respondent's costs application).

REASONS FOR DECISION 1 This is an application for review of the conduct of a public sector agency, the Road Traffic Authority (RTA), brought under s 55 of the Privacy and Personal Information Protection Act 1998 (the Privacy Act). 2 In these reasons the names of all private individuals have been anonymised so as to preserve the privacy of their personal affairs. The name of the public servant who gave evidence of her performance of official functions is not anonymised. 3 The Privacy Act gives individuals who are aggrieved by the conduct of a public sector agency the right to complain to the Privacy Commissioner or the agency about conduct by the agency that may involve the alleged violation of, or interference with, the privacy of an individual, as understood by the Act. 4 In this instance NR and NP, who are brother and sister, complained to the RTA. NR's complaint was that the RTA wrongly disclosed the details of his new private residential address to his estranged de facto partner, J. At the time of the alleged disclosure NR had gone to live at NP's place. NP's complaint is that as a result of obtaining the address, J came to her home and assaulted her. They each seek remedies under the Privacy Act including orders for the payment of monetary compensation. 5 The RTA conducted an internal review in accordance with s 53 and denied contravening the Privacy Act. NR and NP were dissatisfied with the outcome of the internal review, and applied pursuant to s 55 to the Tribunal for review of the conduct. A number of planning meetings were held in an attempt to resolve the matter and limit the issues before proceeding to a hearing. The hearing took place on 1 September 2004. 6 The Tribunal proposed to the parties in the course of the planning meetings, and they agreed, that a conclusion should first be reached on the question of contravention with the question of remedy (including monetary compensation) to be addressed at a further hearing. It is normally desirable to address the question of contravention separately. If there is no adverse finding then there is no need to consider remedy. To obtain one of the remedies (monetary compensation) the applicant must produce particular evidence (see s 55(4), cited later in these reasons). 7 As it transpired, in light of the evidence heard on 1 September, the Tribunal modified its approach. It permitted the hearing to extend to the question of whether the precondition to making an order for monetary compensation was established. Section 55(4)(b) requires that the harm suffered by the applicant must be 'because of the conduct' upon which the applicant relies. The issue of causation was a live one in this case. 8 Consequently, this decision deals with two matters: the question of whether there has been a contravention identified, and, if so, whether the precondition for making a monetary compensation claim (a causal link between the contravention and the harm) has been satisfied. 9 At hearing oral evidence was given by NR, NP, Ms Dew-King (Customer Services Operator, RTA) and J. The Tribunal also had before it documents filed in the course of the planning meetings as well as at hearing. The applicants filed several documents including their letters of complaint to the RTA, a joint statement, parts of statements made by NP in connection with Family Law Act proceedings involving NR and J relating to the custody of their child, L, and statements from two friends. The RTA also filed several documents including statements from Ms Dew-King, a statement from J and various documents relating to RTA's official practices in respect of the handling of personal information and copies of the registration certificate. Relevant Law 10 The Information Protection Principle (IPP) in issue in this case is s 18 which provides: ' 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.' 11 The IPPs including s 18 apply to 'personal information'. 'Personal information' is primarily defined by s 4(1). That definition is subject to a number of exclusions. In this case the RTA referred to the exclusion of information contained in a 'publicly available publication'. This exclusion is found in s 4(3)(b) read in conjunction with s 3. The relevant provisions follow. ' 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. … (3) Personal information does not include any of the following: … (b) information about an individual that is contained in a publicly available publication.' 12 Section 3 provides: ' publicly available publication does not include any publication or document declared by the regulations not to be a publicly available document for the purposes of this Act.' (There is no declaration by regulation bearing on this case.) The Circumstances 13 NR separated from J in May 2002 after ten years together. J continued to live at the couple's former home in Pennant Hills with their daughter, L, then four years old. At the time of the separation, NR, who is a licensed plumber, took with him one of two vehicles registered in his name, a work vehicle. He left behind a 1997 Holden VX stationwagon. J's evidence was that she had contributed substantially to its purchase, and to costs such as third party and comprehensive insurance. 14 The RTA's standard motor registration details include mailing address of owner, residential address of owner and the garaging address of the motor vehicle. 15 It is not in dispute that NR attended the Thornleigh branch office of the RTA on 28 April 2003; and that changes were made that day to the mailing address and the registration address. The garaging address remained the same as previously. 16 NR asserts and the RTA denies that the officer of the RTA with whom he dealt on 28 April 2003 promised that the RTA would not disclose his new residential address to any other people. 17 NR's evidence is that he went to the Thornleigh branch of the RTA on 28 April 2003, with a view to having the mailing and residential address on the registration certificate changed to his new address. He also stated that he wanted to have the address restricted so that J, in particular, could not find it. He said he asked the officer for his address not to be given out to anyone else. He said that he did not go into any details as to why he wanted to be sure of that. He said that he was assured by the officer that no one other than himself could get his new address. The RTA did not produce any statement from the officer who dealt with NR that day (her name appears on the print out). 18 The RTA relies on the fact that there is no record of a request to suppress the address. Without such a request there is nothing an officer can do to give effect to a request of the kind that NR says he made. The RTA disputes that NR received any such promise. 19 The address suppression policy (see documents filed by RTA 30 April 2004, 'Recording addresses', at p 4 'Suppressed addresses') does not contemplate something as simple as an officer making a promise to restrict an address, and actioning it immediately. The policy has special procedures for suppression. The effect of suppression is that the protected address is not shown on the computer database used by staff. There are some special procedures for people in security sensitive occupations who seek address suppression. For people such as NR the instruction is that staff are to give them an application form. They must set out the basis for their claim and have the application supported by a local police officer. 20 The difficulty is that, apart from the computer print out, the only direct evidence of what occurred that day, or might have occurred that day, is that given by NR. 21 In the Tribunal's opinion, NR was likely, considering the degree of the estrangement between him and J, to have wanted to suppress his address. He was unhappy that she still had the car. The Tribunal's view is that at this stage of the separation he was looking for ways of getting the car back; even though clearly it was of benefit to a continuing object of his affection, L, the baby daughter, for her mother to have the use of a car. He was also looking at how he could obtain custody of L. 22 In the Tribunal's opinion it is likely that he was trying to build a wall between him and J, which included trying to limit her knowledge of his whereabouts. It is more likely than not that he made an inquiry about suppression, though he did not use such a technical word to describe what he wanted. 23 The Tribunal only has NR's direct evidence as to what he was told. The Tribunal has had regard to the sustained challenge made to NR's credibility by way of cross-examination. Some doubts were raised. 24 Finding re 28 April 2003: Nonetheless the Tribunal is satisfied that NR was generally credible, though clearly he had not given until the hearing a full picture of the events of early July (events material to the claim of NR and his sister for compensation). The Tribunal is satisfied, on balance, that NR did request that his address not be given to any other person, was given a promise that that would occur, and, for reasons unknown, the promise was not actioned. 25 On 1 June 2003 the RTA dispatched the registration renewal notice to NR at his new address. 26 J continued to use the Holden. She knew from past experience that the registration fell due on 1 July 2003. She did receive a compulsory third party insurance renewal notice in the ordinary course. It was in her name. But there was no sign of the registration renewal notice. She became increasingly concerned about its absence. 27 Her evidence was that she questioned NR over its absence during June. He denied having it. She also asked him where he was living. Her evidence is that on a visit to her home in mid-June she asked him where he was living and he told her the street name and the suburb – Old Toongabbie. Some time later on that visit she heard him speaking to a friend on his mobile phone, in the course of which he gave the friend his full address, including street number. She said that she had known for some time that NR was living at his sister's place, and basically where it was. Through sightings of him turning into the street, reported to her by mutual acquaintances, she had found out the name of the street and the suburb, Old Toongabbie. 28 As the registration was due to run out in a few days, and she needed to get an inspection report done, J went to the Thornleigh branch on 26 June 2003 in order to reregister the car. She explained that she did not have the registration notice. J states that after showing the third party renewal notice and giving certain information to the counter officer (name of owner, date of birth, type of car, number plate, residential address of owner) she was provided with a copy of the registration renewal notice and proceeded to obtain an inspection report (the 'pink slip'). Consequently, there was a disclosure by the RTA of NR's address information. 29 On 1 July 2003 she reregistered the car. 30 Ms Janet Dew-King testified that she did not have a specific recollection of dealing with J, but gave evidence as to the usual procedures followed by RTA officers when third parties (such as family members or employees of the owner) come to reregister cars. If the third party is able to show an association with the car through, for example, having registration papers or having the name and address of the owner they may be given a registration renewal notice or be permitted to reregister the car. Ms Dew-King said that she would have abided by instructions and would have asked the customer for the new ownership address as one of the matters to be authenticated. She annexed the policy that she said applied to her affidavit (headed 'Printing a renewal notice'). 31 The policy 'Printing a renewal notice' does not precisely cover this situation. The customer to which it refers is clearly the person to whom the renewal notice would or should have been sent. Here that person was NR. NR did not present at the counter. 32 There is nothing in the other material filed with the Tribunal by the RTA precisely reflecting Ms Dew-King's description of standard practice. The policy relating to release of information to third parties is headed 'What information can customers request?' (bundle filed 30 April 2004). The policy allows for release based on 'implicit consent' of the customer. Maybe the practices that the RTA staff follow involve a judgment as to 'implicit consent'. 33 NR's conviction that the RTA's conduct was critical, and that otherwise J would not have found out his new address, is based on a telephone conversation with J that occurred shortly after 1 July 2003. J told him, he said, that she had reregistered the car, she had got his address from the RTA, and added 'Don't fuck with me now, I know where you live'. 34 Finding re 26 June 2003: The Tribunal accepts the evidence of J and Ms Dew-King. The Tribunal is satisfied that, despite the firm view held by NR and NP to the contrary, J was in possession of NR's exact address when she requested the registration renewal notice; and that Ms Dew-King is likely to have followed her usual practice and acted in accordance with what she understood were current instructions in dealing with J. (These findings should not be read as inferring any conclusion by the Tribunal as to whether the screening procedure itself conforms with the Privacy Act.) The Tribunal accepts J's evidence that she overheard a phone conversation in which NR give his address to a friend. 35 It may be that, as NR says, J told him that she got the address from the RTA. This may have been an explanation offered in anger, one which hid the true story. The Question of Contravention 36 The RTA contends that the Privacy Act is entirely inapplicable as the information in issue (NR's new residential address) lies outside the scope of the Act as it is contained in a 'publicly available publication'. 37 The RTA relied on two items of evidence to support this contention. 38 The first was the Telstra White Pages showing an entry for NP's de facto partner, D, under his surname and initials. The telephone book entry is then followed by full details of their address. This is clearly not information published in connection with NR and cannot be relied upon. 39 As noted earlier, NR is a licensed plumber. The Office of Fair Trading (OFT) is responsible for licensing. The OFT database can be searched by anyone wishing to check the licence particulars of licensees under statutes administered by the OFT. The second item of evidence is the entry found against NR's name on the Office of Fair Trading (OFT) internet site. 40 The search record produced (a search done on the day of the hearing, 1 September 2004) shows against NR's name the Old Toongabbie address as his 'business' address. (There is nothing in the record referring to a residential address.) 41 A print out dated 1 September 2004 tells the Tribunal nothing as to the position that existed on 26 June 2003. There is no direct evidence before me as to what the OFT practices were as at 26 June 2003, and what their database disclosed at that time. I acknowledge that there was evidence from NR that he did give OFT his new address as his new licence address at or around the time he changed address. 42 In these circumstances, the agency has not produced sufficient evidence to justify further consideration of the application of the exclusion. 43 As noted earlier, s 18 prohibits disclosure of personal information subject to various exceptions. 44 The RTA relied on the exception in sub-s (1)(a). It contended that the disclosure was 'directly related to the purpose for which the information was collected' and it had 'no reason to believe that the individual concerned would object to the disclosure, …'. 45 In this case it is clear, the Tribunal considers, that the disclosure was 'directly related' to the purpose for which the information was collected. 46 In light of the Tribunal's finding that NR asked for his address information not to be disclosed, the Tribunal is satisfied that the RTA did have reason to believe that he would object to the disclosure that occurred on 26 June 2003. Mr Nathans for the RTA acknowledged that the consequence of such a finding is that a contravention of s 18(1)(a) is established. 47 The Tribunal finds that the RTA contravened s 18(1)(a). Question of Remedy 48 The Tribunal may dispose of the case by deciding to take no further action, or by making an order or orders. Section 55(2)-(4) provides: '(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997. (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.' 49 Much of Mr Nathans' cross-examination of NR, and the evidence he elicited from J, went to the question of the extent of the animosity between NR and J, and also to the animosity between NP and J. 50 The Tribunal heard that L had since the separation never been made available to NR for weekend stays until the first two weekends of July 2003. NR acknowledged that he had deliberately not returned L after the second of these weekend visits (12-13 July 2003). J had gone away that weekend to Parkes. NR acknowledged that he had taken the opportunity of J's absence to remove, from the inside of the house and from the sheds outside, various work and personal possessions. NR had also arranged for a video to be taken of the internal state of the house. He intended to use the video in a Family Law application to have the custody of L transferred to him. 51 J returned home late on Sunday 13 July. L had not been returned. She was agitated. A friend, S, drove J to NR's place on the morning of Monday 14 July. L was due to attend pre-school. NP's evidence is that J assaulted her, and she was seriously injured. In her present application she has claimed compensation for time off work (5 days), ambulance, medical and hospital expenses as well as general trauma. (NR made a claim based on trauma.) J's version of the events is that any injuries that occurred took place in the course of an altercation between her and NP where her object was to try and recover L. 52 NP and NR made statements to the police, and NP pressed for charges against J. Parramatta Court heard the charges on 18 November 2003. The ruling was given on March 2004, dismissing them. 53 The events of 14 July can not, the Tribunal considers, be linked in any sensible way to the disclosure that occurred at the RTA when the registration renewal notice was given to J. The Tribunal has already found that it is satisfied that J knew the address precisely when she attended on the RTA. Moreover, she had known, the Tribunal considers, for some time the general details of NR's whereabouts, such details as the fact that he was living at his sister's place, the street name and the suburb. Given the animosity that existed between the parties, especially after the unexplained non-return of L, she would, the Tribunal thinks, have speedily tracked down NR even if she had not had the street number. 54 The pre-condition for monetary compensation required by s 54(4)(b) – 'that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency' – is not made out. 55 Neither applicant is entitled to an award of monetary compensation. 56 Standing of NP to bring Application: The RTA also raised the question of the standing of the co-applicant, NP. Mr Nathans noted that the right to bring an application for review is given to a 'person aggrieved' when s 55(1) is read in conjunction with s 53(1) (the provision dealing with the making of an application for an internal review). 57 It is not now necessary to rule on this matter in light of the Tribunal's finding on the causation issue. Mr Nathans indicated in the course of argument that his specific concern in making this submission related to whether NP was entitled to claim monetary compensation. 58 The Tribunal makes the following brief observations. Standing to apply to the Tribunal is given by the Privacy Act to a 'person aggrieved' by the conduct in issue. On the other hand the rights conferred by the Act seek to protect the personal information of 'individuals'. Had the Parliament intended to limit standing to those individuals it would, presumably, have used that term rather than 'person aggrieved'. As a matter of statutory construction, the 'applicant' referred to in s 55(2)(a) is the 'person aggrieved' referred to in s 53(1), by dint of the definition of 'applicant' found in the latter provision. So, it may be the case that a 'person aggrieved' other than the individual affected by the contravention could make a claim for monetary compensation. 59 The Tribunal has now dealt with the matters requested by the parties to be dealt with to this stage of the proceedings. Other Matters 60 There remains for consideration whether any other orders should be made by the Tribunal in relation to the contravention. 61 One way this aspect of the matter might be resolved is for the RTA simply to provide NR and NP with a letter of apology to the effect that in light of the findings of the Tribunal it regrets it disclosed personal information about NR to a third party on 26 June 2003 when it had reason to believe that the subject (NR) would object to such a disclosure. The Tribunal's provisional view is that this is not a case to which an order of a systemic kind is relevant. 62 Application for Costs: The RTA has made an application for an order for costs against the applicants. That application has been stood over for submissions until after this decision is published. 63 The matter will be relisted for further directions as to the making of final orders, and to deal with the respondent's costs application. Order 1. A contravention of s 18(1)(a) is established. 2. The applicants' application for an order for monetary compensation pursuant to s 55(2)(a) of the Privacy and Personal Information Protection Act 1998 is dismissed. 3. Application to be relisted for planning meeting as to remaining matters (any other order; respondent's costs application).