GA V Department of Education and Training [2005] NSWADT 105

CITATION: GA V Department of Education and Training [2005] NSWADT 105 DIVISION: General Division APPLICANT PARTIES: GA RESPONDENT Department of Education and Training FILE NUMBER: 053043 HEARING DATES: 9/05/2005 SUBMISSIONS CLOSED: 05/09/2005 DATE OF DECISION: 05/13/2005

BEFORE: Hennessy N - Magistrate (Deputy President) APPLICATION: Privacy - information protection principle - personal information - use MATTER FOR DECISION: Principal matter LEGISLATION CITED : Privacy & Personal Information Protection Act 1998 CASES CITED: Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 APPLICANT REPRESENTATION: In person RESPONDENT M Filippeli, solicitor ORDERS: The Tribunal determines not to take any action on the matter

REASONS FOR DECISION Introduction 1 The background to this application is that on 12 August 2004 Mr Anthony Bendall, the Manager of Freedom of Information and Privacy for the Department of Education and Training, filed an affidavit in the Tribunal in relation to another matter involving the applicant and the respondent, namely matter number 023250 ("the previous matter"). The affidavit set out, in detail, the procedural history of the previous matter and annexed all the relevant documentation and correspondence. At paragraph 5 of the affidavit, Mr Bendall said: On 4 November 2002, an application was filed in the Administrative Decisions Tribunal seeking a review of Mr Waterhouse's decision. A copy of that application is attached and marked F. 2 Mr Waterhouse's decision was an internal review decision under the Privacy and Personal Information Protection Act 1998 (PPIP Act). Annexure F contained the applicant's application and every document filed with that application including an Application for Waiver of Fee which had been completed by the applicant. That document contained information about the applicant's financial affairs including his income and expenses. At the bottom of the application the words "Fee Waived" were circled and the form was signed by the Registrar and dated 4 November 2002. As the Tribunal takes on the responsibility of serving applications on respondents in relation to matters in the General Division, the Tribunal served the application including the Application for Waiver of Fee on the respondent. The respondent then included a copy of the entire application including the Application for Waiver of Fee in their affidavit. That affidavit was filed in the Tribunal and served on the applicant. On 11 June 2003, the Tribunal made a suppression order in relation to the name of the applicant. The previous matter has been determined by the Tribunal but is currently on appeal to the Appeal Panel. The hearing before the Appeal Panel is listed for 29 June 2005. 3 In these proceedings, the applicant claims that the respondent has breached sections 12, 13(a) and 16 of the PPIP Act in relation to the personal information in the Application for Waiver of Fee. I am satisfied that the information in the document which records the applicant's financial situation is "personal information" as defined in s 4 of the PPIP Act. I am also satisfied that the information was "held" by the respondent in accordance with s 4(4). The applicant did not rely on any breach of provisions relating to the "collection" of the information in the document, (s 8, 9, 10 & 11) presumably because the document was "unsolicited" and therefore not "collected": s 4(5). (See Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 at [86]). Furthermore, the respondent would have had a defence under s 30 of the PPIP Act if the applicant had relied on either s 10 or s 11. That is because their Privacy Code of Practice provides an exemption from s 10 and s 11 in relation to the use of information "for the purpose of obtaining legal advice and representation or for use in legal proceedings." Similarly, the applicant did not rely on any breach of the provisions relating to "use" (except s 16) presumably because s 17 is premised on the agency having first collected the information. The respondent submitted that it has not breached s 12, 13(a) or 16. 4 The Tribunal's role is to review the respondent's conduct in relation to the information and to determine whether any of the nominated sections have been breached. If there has been a breach, then it is up to the Tribunal to determine whether it is appropriate to make an order in favour of the applicant. Retention and security of personal information: s 12 5 The applicant submits that the respondent has breached s 12(a), (b) and (c) of the PPIP Act. Those provisions are set out below: A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and 6 The applicant alleges that the respondent continues to breach s 12(a) by holding the Application for Waiver of Fee when it has no lawful use for that information. The respondent submitted that it did not "use" the information and relied on comments that the Tribunal had previously made about the meaning of "use". For example, the Tribunal said in FM V Macquarie University [2003] NSWADT 78 at [42] that: "The plain and ordinary meaning of the word 'use' in this context is 'to avail oneself of; apply to one's own purposes.'" I am satisfied that by including the information in an annexure to an affidavit, the respondent has "used" the information because it has applied it for its own purposes as part of its defence in legal proceedings. 7 Section 12(a) relates to the period of time which an agency must keep information. That period is "no longer than is necessary for the purposes for which the information may lawfully be used." The applicant submits that the respondent should not have kept the information because it is irrelevant to any issue in the previous proceedings and there is therefore no lawful purpose for which it can be used. The PPIP Act is silent in relation to the purposes for which information which has not been collected, but which is nevertheless held by an agency, can lawfully be used. The Tribunal must look to the general law in order to ascertain whether the purpose for which the agency used and continues to use the document was lawful or not. 8 Although the applicant submitted that the document was not relevant to any issue in the previous proceedings, that does not make its use as an annexure to an affidavit in those proceedings "unlawful". In fact, the respondent's Privacy Code of Practice contemplates that information will be used "in legal proceedings." (See Department's Privacy Code of Practice: 15.1.5 and 16. 1. 9.) I am unable to identify any law, either written or unwritten, which would prohibit the respondent from using the information in the document as an annexure to an affidavit in legal proceedings. Consequently there has been no breach of s 12(a). 9 In relation to s 12(b) the applicant submitted that one of the requirements for the disposal of personal information referred to in s 12(b) is the requirement in s 12(a). As I have found that there has been no breach of s 12(a), it follows that, even if the applicant's submission about the relationship between s 12(b) and s 12(a) is accepted, there has been no breach of s 12(b). 10 Section 12(c) relates to the security safeguards which an agency must take in order to prevent, among other things, any misuse of information. The applicant's submission is that the respondent could not have taken reasonable security measures because the information was in fact "misused" by being accessed and used by staff and included as an annexure to an affidavit. The applicant maintained that the information in the document was used in contravention of the PPIP Act but, as I have said, the Act does not specify the ways in which unsolicited documents may lawfully be used. The only way the document could have been "misused" is if it was used for an unlawful purpose. As I have found that the information in the document was not used for an unlawful purpose, it follows that there has been no breach of s 12(c). Information about personal information held by an agency 11 The applicant alleges a breach of s 13(c) in that the respondent did not take reasonable steps to enable him to ascertain the nature and purpose of the information in the document. Section 13(c) states that: A public sector agency that holds personal information must take such steps as are, in the circumstances, reasonable to enable any person to ascertain: (c) if the agency holds personal information relating to that person: (i) the nature of that information, and (ii) the main purposes for which the information is used, and (iii) that person's entitlement to gain access to the information. 12 The respondent submitted that it took the step of including the information in an affidavit which was served on the applicant. The respondent says that that was a reasonable step to enable the applicant to ascertain the nature of the information it held and the main purpose for which it was being used. I am satisfied that this was a reasonable step to enable the applicant to ascertain the matters in s 13(c). I cannot identify any other steps which, in the circumstances, the respondent should have taken. Consequently, there has been no breach of s 13(c). Checking accuracy and relevance: s 16 13 The applicant's final submission was that the respondent had breached s 16 which states that: A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 14 The applicant submitted that the information was not relevant and that the respondent did not take reasonable steps to ensure that it was relevant. I am satisfied that the respondent "held" and "used" the information. I am also satisfied that the information was not directly relevant to any issue in the proceedings. The respondent did not maintain, for example, that it was necessary to include that information to establish that the Tribunal had jurisdiction despite the fact that a filing fee had not been paid. Just because the Tribunal provided the information to the respondent as part of the applicant's application does not make it relevant to an issue in the proceedings. However, the question is whether the respondent took such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information was relevant. 15 The circumstances are that the Tribunal provided a copy of the Application for Waiver of Fee to the respondent when serving the applicant's application. In an affidavit setting out the procedural history of the application, the respondent annexed all the documents which had been filed by each party and a copy of the correspondence between the parties. Both the applicant and the Tribunal already had copies of the Application for Waiver of Fee and there was a suppression order in place in place in relation to the name of the applicant. Given those circumstances, and the purpose for which the information was proposed to be used, I am not satisfied that the respondent's conduct amounts to a breach of s 16. Orders 16 The Tribunal determines not to take any action on the matter.