JD v Director General, NSW Department of Health [2004] NSWADT 7

CITATION: JD v Director General, NSW Department of Health [2004] NSWADT 7 revised - 23/02/2004 DIVISION: General Division APPLICANT PARTIES: JD RESPONDENT Director General, NSW Department of Health FILE NUMBER: 033158 HEARING DATES: On the papers SUBMISSIONS CLOSED: 12/16/2003 DATE OF DECISION: 01/15/2004

BEFORE: Higgins S - Judicial Member APPLICATION: Jurisdiction MATTER FOR DECISION: Preliminary matter Administrative Decisions Tribunal Act 1997 LEGISLATION CITED : Medical Practice Act 1992 Privacy & Personal Information Protection Act 1998 CASES CITED: GL v Director-General, Department of Education and Training [2003] NSWADT 166 APPLICANT REPRESENTATION: In person RESPONDENT K Thomas, solicitor ORDERS: 1 The Tribunal has jurisdiction to hear the applicant's request to review the conduct subsequently particularised that is alleged to breach s16 of the Privacy & Personal Information Protection Act 1998.; 2 Registry to list the matter for a further planning meeting which is suitable to all the parties

BACKGROUND 1 On 18 June 2003 JD lodged an application with the Tribunal seeking review of the Director-General's, NSW Health Department ("Director-General") failure to make a decision in respect of JD's request for an internal review of conduct by officers of the Department (ie. the Pharmaceutical Services Branch ("the PSB")). This application for internal review was made pursuant to s.53(6) and s.55 of the Privacy and Personal Information Protection Act 1998. The conduct for which review had been sought was the conduct of the PSB in collecting and presenting evidence to the Medical Board about whether it should suspend JD's registration as a medical practitioner or whether to impose conditions on his registration pursuant to s.66 of the Medical Practice Act 1992. 2 JD's application first came before the Tribunal at a planning meeting on 12 August 2003. At this planning meeting, Ms L O'Shannessy, on behalf of the Department, acknowledged that an internal review had not been conducted following JD's request for an internal review, on 13 April 2003. She also acknowledged that the Department had not acknowledged receipt of JD's request or his request for internal review. She informed the Tribunal that the Director-General would conduct an internal review and file and serve such a review on or before 2 September 2003. Directions were made in accordance with such an undertaking. 3 The matter next came before the Tribunal at a further planning meeting, on 23 September 2003. Prior to this planning meeting, JD had responded to the Department's internal review, which had been filed with the Tribunal on 29 August 2003. That response was to the Department alleging that the Department had failed to consider the conduct complained of against s.16 of the Privacy and Personal Information Protection Act 1998. That is, he alleged that the PSB had failed to take reasonable steps to ensure the accuracy of the information it had gathered and then provided to the Medical Board of NSW for the purpose of s.66 of the Medical Practice Act 1992. 4 JD's response did not specify the conduct which he alleged breach s16. As a result, on 23 September 2003, the Tribunal made directions that JD was to file and serve written submissions outlining the conduct, which he alleged came within s.16 of the Privacy and Personal Information Protection Act 1998. At the same time the Tribunal directed that the Department was to file and serve a written response to JD's submissions concerning s.16 of the Act. 5 The parties complied with the orders that were made. In its submissions the Department raised a preliminary issue in respect of the jurisdiction of the Tribunal to consider conduct, which JD had identified as coming within the terms of s.16 of the Privacy and Personal Information Protection Act 1998 and which was not the subject of the initial request on which the Department conducted its internal review. It was the Department's contention that the conduct that had been subsequently particularised by JD amounted to a fresh application for internal review and that it was statute barred by reason of s.53(3)(d) of the Privacy and Personal Information Protection Act 1998. 6 A further planning meeting was held on 6 November 2003. At this planning meeting, Ms Thomas, on behalf of the Department, requested a separate hearing on the jurisdictional issue that had been raised by the Department in its submission concerning the conduct subsequently particularised by JD to breach s.16. She submitted that it was this conduct, which had become the focus of JD's complaint and a hearing on the substance of this aspect of his complaint would be time consuming and costly. The time and cost devoted to such a hearing would be wasted if the Tribunal accepted the Department's submission that the Tribunal had no jurisdiction in respect of this conduct. 7 In light of this, and with the agreement of the parties, the Tribunal ordered that a separate determination be made in respect of this preliminary jurisdictional issue. The parties also agreed that such a determination would be made on the papers after the Privacy Commissioner was given an opportunity to file and serve submissions in respect of this issue. 8 It should be noted that the Privacy Commissioner attended the Planning Meetings and made written submissions. The Privacy Commissioner is given a right to appear and be heard in these proceedings pursuant to section 55(7) of the Privacy & Personal Information Protection Act 1998. 9 It should also be noted that the identity of the applicant is subject to an order under s75(2) of the Administrative Decisions Tribunal Act 1997. 10 Accordingly, this decision relates to the primary issue as to whether the Tribunal has jurisdiction in respect of the conduct subsequently particularised which JD alleges breaches s.16 of the Privacy and Personal Information Protection Act 1998. Relevant legislation 11 The Privacy & Personal Information Protection Act 1998 ("PPIPA") makes provision for the protection of personal information by a "public sector agency". The term "public sector agency" is defined in s.3 of the PPIPA. In this case there is no dispute that the Department and the PSB of the Department come within the terms of this definition. 12 The term "personal information" is defined in s.4(1) of the PPIPA. That section provides as follows: "s.4(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion". 13 The basis on which personal information is protected is through specified information protection principles which are contained in Part 2 of the PPIPA. Section 16 relates to the principle that an agency must check the accuracy of personal information before it uses that information. This section provides as follows: "s.16 A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading". 14 Section 4(4) of the PPIPA defines, for the purpose of the Act, when personal information is "held" by a public sector agency. That section provides as follows: "s.4(4) For the purposes of this Act, personal information is held by a public sector agency if: (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act, 1998". 15 Part 5 of the PPIPA makes provision for the review of "conduct" of a "public sector agency" which is alleged to contravene an "information protection principle" that applies to the agency (see s.52(1)(a) PPIPA). The procedure for such a review is set out in s.53 to s.55 of the PPIPA. The first step that is required is for an applicant, who is aggrieved by the conduct of a public sector agency, to make an application for an internal review of the conduct of the agency that the applicant alleges contravenes an information protection principle (see s.53(1) PPIPA). 16 Sub-section 53(3) sets out the requirements of an application for internal review. That section provides as follows: "s.53(3) An application for such a review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under sub-section (8) may be sent, and (d) be lodged with an Office of the Public Sector Agency within six months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations". 17 Sub-section 53(6) of the PPIPA provides that the public sector agency must complete a review within sixty days after which the application was received. If the review is not completed within that time the applicant is entitled to make an application under s.55 to the Tribunal for a review of the conduct concerned. 18 Where the public sector agency completes an internal review, and the applicant is not satisfied with the findings of the review or the action taken by the agency in relation to the application, that person has a right to apply to the Tribunal for a review of the conduct that was the subject of the person's internal review application (see s.55(1) of the PPIPA). Evidence 19 As mentioned above, on 15 April 2003, JD made a written request, pursuant to the PPIPA, to the PSB. In that request he stated the following: "I formally request that you instigate a review of the way you collected (and processed) information pertaining to All evidence given at section 66 Medical Board hearing on…. at Gladesville, in my matter . Thank you very much. In particular, the copying of files and scripts at [ name deleted] Med Centre, [location deleted] NSW" . 20 There is no dispute that the conduct referred to in JD's request for internal review occurred between 6 November and 19 December 2002. That is, this is the period during which the PSB conducted its investigation into complaints made against JD and when the PSB presented the evidence it had gathered to the Medical Board. 21 On 2 June 2003, JD wrote to the Director-General of Health. In that letter he stated the following: "Some 6 weeks ago I asked Pharmaceutical Services DIRECTLY and INDIRECTLY (through your office) for INTERNAL REVIEW under the Privacy and Personal Information Act, 1998 of all evidence presented to section 66 HEARING on….at Medical Board Enquiry (my matter), ALL PATIENT FILES, ALL PATIENT prescriptions (the Poisons and Therapeutic Goods Act, 1996 is not relevant to the Internal Review). Please conduct internal review as requested six weeks ago (under P & PI Act, 1998 )". 22 The applicant again wrote to the PSB, on 3 June 2003. In that letter he stated the following: "…There seems to be some confusion about my request to you 6 weeks ago I requested by FAX to Mr Lumby (and sent exact copy of my fax request to Ms KRUK'S office) "REQUEST FOR INTERNAL REVIEW BY NSW HEALTH under Privacy and Personal Information Act, 1998 ": Requesting a Review of ALL Documents (photocopies of files, prescriptions etc) presented by NSW Health at my section 66 HEARING on … Again I Remind you of my formal written request of 6 weeks ago. Thank you again in this matter". 23 A further letter was sent by JD to the Director-General of Health on 13 June 2003. It is this letter, which is attached to JD's application for review that was lodged with the Tribunal. In that letter JD stated: "I once again request that you carry out internal review of All Evidence obtained/presented by Pharmaceutical Services Branch on… at my my section 66 HEARING at Gladesville (NSW Medical Board). (I request Formal Review under the Privacy and Personal Information Act, 1998 (as amended) )" . 24 On page 2 of this letter JD set out the details of the alleged breach by the pharmaceutical services branch. These he stated to be as follows: "(1) Photocopies of confidential files from The [ name deleted] Medical Centre ex ten patients . (2) My confidential (tax) doctor's bag receipts from [name deleted] Pharmacy, [location deleted]and other confidential receipts/documents. (3) Photocopies of my confidential prescriptions Total of about 12 scripts copied for 2 patients (…) from [name deleted] Pharmacy and other pharmacies". 25 On 14 October 2003, JD provided written submissions on the conduct that he alleged breached s16 of the PPIPA. He stated as follows: "…I submit that NSW HEALTH has multiple counts of BREACHING P and PI Act, Section 16 by virtue of Information published by NSW Health to NSW Medical Board in …". 26 JD then goes on to give details of what he alleges is false, inaccurate or misleading information that was provided by the Department to the Medical Board. In summary, these are as follows: (a) publication of a statement of witness A which is alleged to be untrue/inaccurate/misleading. In this regard JD asserts that he had not spoken to this witness for several years and that she has well known personal animosity towards him. He goes on to state that the PSB failed to obtain statements from other witnesses who would state the contrary to that stated by witness A. (b) publication of a statement allegedly made by witness B that JD was "stealing drugs". JD states that witness B denies having made such a statement. (c) failure of the PSB to obtain and examine JD's electronic patient and prescribing records, which JD alleges supports his proper clinical management and prescribing patterns for his patients. 27 On 17 October 2003, JD made further submissions in respect of conduct that he alleged was a breach of s.16 of the PPIPA. In particular he stated: (a) the PSB had incorrectly stated the period he had worked at a particular health centre; (b) the PSB had relied on a statement from witness D who had alleged that JD's drawers were "full of uppers and downers". JD denies this allegation and states that on proper inquiry the PSB would have ascertained that the alleged statement was false. (c) the PSB provided concocted/fabricated evidence to the Medical Board. This is a general allegation which includes those matters listed above and those listed in the preceding paragraph. 28 In all cases JD alleged that the conduct complained of was conduct where the PSB had failed to take reasonable steps to ensure the accuracy of the information upon which it relied. He went on to state that this was a requirement of s16 of the PPIPA and in this case, where the PSB was using information it had collected that was extremely damaging it had an even greater obligation to test that information as to its truth. 29 It is not disputed that following an investigation by the PSB, the investigating officer prepared a report and it was this report, which was provided to the Medical Tribunal as evidence in the hearing, concerning JD, under s. 66 of the Medical Practice Act 1992. The Tribunal has not been provided with a copy of that report. Nor, other than in a general sense, has the Tribunal been provided with details of the material that the PSB held and exactly how it was used. These are matters for determination if the Tribunal finds that it has jurisdiction in respect of such conduct. Submissions 30 Ms Thomas, on behalf of the Department, provided detailed written submissions on the issue of the Tribunal's jurisdiction to hear JD's application in so far as it relates to the conduct which JD has subsequently identified as alleged breach s.16 of the PPIPA. The essence of these submissions is that by virtue of s.53 of the PPIPA the Tribunal only has jurisdiction to review a public sector's agency conduct where an application for review of that conduct has been made by the applicant. In this case, Ms Thomas submitted that the conduct identified by JD, which he alleges to be in breach of s.16 of the PPIPA is different conduct to that for which he sought an internal review in his application of 15 April 2003. It is submitted that the s.16 conduct was not identified by JD until 4 September 2003, which was outside the six month period provided for in s.53(3)(d) of the PPIPA. 31 Ms Thomas went on to state that, while the Department has a discretion to accept out of time applications under that section, in this case the Department would not exercise its discretion in favour of JD She further points out that the Tribunal has no jurisdiction to review such a decision or to order that the Department undertake an internal review in respect of such conduct. 32 Mr Dickie, the Acting Privacy Commissioner, submitted that the Tribunal should exercise caution when considering the argument that an issue raised before the Tribunal is beyond the scope of the original internal review because it was not directly referred to in the applicant's originating correspondence. He pointed out that a review under s.52 of the PPIPA, expressly refers to a review of "conduct" that allegedly breaches one of the information protection principles in Part 2 Division 1 of that Act, rather than simply a review of an alleged breach of one or more of those principles. Consequently, the same conduct has the potential to breach more than one principle and a respondent public sector agency should not be able to protect itself against subsequent review by the Tribunal by selectively and unilaterally determining the scope of the conduct to which an internal review applies. 33 Mr Dickie also submitted that in respect of the Department's submission that it would not exercise its discretion under s.53(3)(d) of the PPIPA raises an issue of fact in that the Tribunal is required to determine when the applicant became aware of the conduct complained about. It is acknowledged that the discretion under s.53(3)(d) of the PPIPA has been held to be a non reviewable discretion, but this does not prevent the Tribunal from determining as a matter of fact, when the applicant became aware of the conduct in question. 34 In his submissions, JD pointed to the fact that it was the Department which had failed to conduct an internal review within the time prescribed in the legislation and it was not until he had made his application to the Tribunal that they were moved to do so. He submitted it was unconscionable for the Department to now state that he had delayed in raising the conduct in question. He also invited the Tribunal to adopt the submissions made by the Privacy Commissioner. Reasons and decisions 35 In my opinion, the issue to be determined is whether the conduct, which JD alleges is a breach of s.16 of the PPIPA can be said to relate to, or be incorporated in, the conduct specified in his original request for an internal review. At this stage of the proceedings it is not necessary to determine definitively whether the conduct is in fact conduct coming within s. 16 of the PPIPA. What is required is whether the conduct subsequently particularised is a reference to the same conduct the subject of the original request for review or whether it is entirely different conduct. If it is the latter, then I agree with the submissions of Ms Thomas that the Tribunal has no jurisdiction to review that conduct under s. 55 of the PPIPA. Nor does the Tribunal have jurisdiction to order the Department to conduct an internal review of such conduct. 36 On the material before the Tribunal, there can be no question that JD was aware of the conduct in question on or about 19 December 2002. That is, this is the date on which the 6 month limitation period commenced for JD to make his application for internal review as required by s.53(3)(d) of the PPIPA. This means that if the conduct does not come with the terms of his original internal review request, his request for review of the conduct subsequently particularised is out of time and the Tribunal notes that the Department has indicated that it will not grant an extension of time. 37 In GL v Director-General, Department of Education and Training [2003] NSWADT 166, the Deputy President considered whether s.52(1) of the PPIPA required an applicant for review to identify the information protection principle that he/she alleges has been contravened by the public sector agency. At paragraph 26 the Deputy President stated the following: "While the conduct listed in s.52(1) is the only conduct that the agency or the Tribunal can review, there is no express or implied requirement for an applicant to identify the precise contravention on which he or she relies. If the contravention is not specified, it is up to the agency, or the Tribunal, to identify the relevant contravention with the assistance of the applicant. Apart from rejecting the respondent's submissions as a matter of statutory construction, there are compelling practical considerations for rejecting it. Applicants will not normally have the benefit of legal advice and it is unrealistic in many cases to require them to interpret and apply statutory provisions. While I acknowledged that it may be difficult for a respondent to review conduct without knowing which provision has allegedly been contravened, this can be addressed by discussing the matter with the applicant. Alternatively, the respondent may be able to anticipate from all the circumstances of the case the nature of the alleged breach". 38 I agree with the above statement of the Deputy President in that s.52(1) of the PPIPA requires the applicant for review to identify the conduct of the public sector agency that he/she alleges breaches the Act. While it is desirable for applicants to be as specific and precise as to the conduct complained of, in practice this too may be unrealistic where the applicant is not legally represented and does not have all the relevant information available to him/her when making the application. For this reason, I agree with the submissions of Mr Dickie that a request for internal review of conduct of a public sector agency should not be narrowly construed. If the conduct is subsequently particularised more precisely and this latter explanation of the conduct can reasonably be said to come within the general ambit of the conduct for which review was sought originally, then this latter explanation should be held to be part of the original request. 39 In this case, in his original application for internal review dated 15 April 2003, JD did not specify any information protection principle as having been breached. However, he was quite specific about the conduct for which he was seeking review. This conduct he stated to be "the way you collected (and processed) information pertaining to the evidence given at…" the hearing before the Medical Board. At the same time he mentioned aspects of this conduct that was of particular concern to him. These all related to the "collection" of evidence by the PSB. However, the request also encompassed the "presentation" or use of such evidence by the PSB. 40 In all the subsequent correspondence to the PSB and the Department, including the request of 13 June 2003, which was attached to his application to the Tribunal, JD consistently continued to seek internal review of the evidence obtained and presented by the PSB to the Medical Board. It was not until 13 June 2003 that JD provided further details of what he alleged to be breaches of the PPIPA. It was these alleged breaches that were addressed by the Department in its internal review. 41 In one sense the ambit of JD's application for internal review was very wide in that it related to the entire conduct of the PSB in collecting and presenting evidence at the hearing before the Medical Board. At the same time, the conduct in question occurred over a relatively short period of time and related to a specific event, the Medical Board hearing. 42 In my opinion, having regard to the fact that JD is not legally represented, the terms of the original request for review and the correspondence that followed it, the conduct the subject of JD's original request for review was sufficiently broad to include conduct by the PSB that involved the use of personal information that it had collected concerning JD. The conduct that JD has subsequently particularised, in my opinion, falls within such a description. That is it can be said that it is relate to the use of personal information received. Whether this conduct is in fact a "use" of personal information "held" by the PSB in regard to JD and whether it is conduct that breaches s. 16 of the PPIPA is still to be determined. However, in a general sense I agree that the conduct particularised by JD subsequently comes within the ambit of his original request for review. 43 Accordingly, in my opinion the Tribunal has jurisdiction to hear JD's application for review in so far as it relates to conduct that he has subsequently particularised. Having made this finding it will be necessary for the Registry to set the matter down for a further planning meeting that suits all the parties concerned. 44 As mentioned above, the Tribunal's jurisdiction, for the purpose of s.16 of the PPIPA, is limited to determining whether the PSB has "used" personal information it "holds" in respect of JD and it has done so without first taking steps as are reasonable in the circumstance, having regard to the purpose for which the information is to be used, that the information is accurate. This jurisdiction does not enable JD to use the PPIPA as a vehicle of testing the veracity of the evidence before the Medical Board. That is, it is not a re-run of that hearing or a hearing of the merits of the findings of the PSB or the Medical Board. 45 For the reasons set out above the Tribunal orders: a) the Tribunal has jurisdiction to hear the applicant's request to review the conduct subsequently particularised that is alleged to breach s16 of the Privacy & Personal Information Protection Act 1998 b) Registry to list the matter for a further planning meeting that is suitable to all the parties. Decision revised 23 February 2004: Quotations in Paragraph 19 and 24 amended to delete identifying names and locations.